CVE-2026-86022

Received Received - Intake

Command Injection in VNote Prior to 4.3.0

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-14

AI Q&A

2026-10-14

EPSS Evaluated

N/A

NVD

CVE-2026-86022

EUVD

EUVD-2026-100523

Affected Vendors & Products

Vendor	Product	Version / Range
vnotex	vnote	< 4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This is an argument injection vulnerability in VNote versions 4.2.0 and earlier. It allows arbitrary command execution when a note filename contains a double quote character. The vulnerability occurs because VNote wraps note paths in double quotes when passing them to external programs like vim or gvim. An attacker can craft a filename with a double quote to terminate the quoted path and inject additional arguments into the command. If the external program supports command execution via arguments (e.g., vim -c), this can lead to arbitrary code execution as the user.

Detection Guidance

Check VNote version with 'vnote --version' or inspect installed package. Look for notes with filenames containing double quotes or special characters. Review external program configurations in VNote settings for unusual commands.

Impact Analysis

If you use VNote on Linux or macOS and open a note with a malicious filename containing a double quote, an attacker could execute arbitrary commands on your system. This could lead to data theft, system compromise, or further attacks. The attack requires user interaction (opening the note) but no special privileges. It affects both automatic note opening and the 'Open With' feature.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements under GDPR and HIPAA. If exploited, it may result in unauthorized access to sensitive data, triggering breach notification requirements. Organizations using VNote for handling regulated data must address this vulnerability to maintain compliance.

Mitigation Strategies

Upgrade VNote to version 4.3.0 or later immediately. Disable external program features if not needed. Avoid opening notes from untrusted sources. Review and sanitize note filenames.

Hi! I’m here to help you understand CVE-2026-86022. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70