CVE-2026-122157 · Package
NO FIX YET · SEE WHAT TO DO
Yank Note, a Markdown note app, has a flaw in its terminal handler's permission check that lets a remote attacker inject operating system commands. The exploit is publicly available, so an attacker can run commands on the machine running the affected version.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Affected is Yank Note 3.93.0, where the terminal handler's checkPermission function in src/main/server/index.ts does not block command injection. Teams that run Yank Note with its server or terminal feature reachable from a network are most exposed. Installations that do not run the server component or that are on 3.93.1 or later are not affected.
Not affected if default-config
Who cares electron, node, terminal, yank-note
3.93.0 is affected.checkPermission in src/main/server/index.ts in your build or source.3.93.1A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.