CVE-2026-86022

HighCVSS 7.0

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

VNote prior to 4.3.0 has a vulnerability where a note path is wrapped in double quotes and substituted into a command string that QProcess::start reparses. On Linux and macOS, an attacker can use a double quote in a filename to add arguments to the configured external program, potentially leading to arbitrary command execution.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary commands as the user, potentially leading to system compromise or data theft.

Recommendation

Update VNote to version 4.3.0 or later, which includes the fix.

Other vulnerabilities in VNote

CVE-2026-86016High
VNote prior to 4.3.0 uses innerHTML assignment to insert YAML frontmatter metadata before the XSS protection runs. Opening a malicious Markdown file can execute stored JavaScript in the file:// viewer context, and due to LocalContentCanAccessRemoteUrls, the script can read local note files and transmit them to a remote server.

Original NVD description (English source)

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS