{"id":"CVE-2026-122157","kind":"vulnerability","aliases":["CVE-2026-122157"],"related":[],"title":"Yank Note: terminal handler flaw allows remote OS command injection","description":"A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.","summary":"Yank Note, a Markdown note app, has a flaw in its terminal handler's permission check that lets a remote attacker inject operating system commands. The exploit is publicly available, so an attacker can run commands on the machine running the affected version.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["electron","node","package","terminal","yank-note"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Yank Note version in the app or its package metadata; version `3.93.0` is affected.\n- Look for the function `checkPermission` in `src/main/server/index.ts` in your build or source.","fix":"- Yank Note: upgrade to `3.93.1`","status":"open","published_at":"2026-11-05T02:16:58+00:00","first_seen_at":"2026-11-05T02:31:09+00:00","triaged_at":"2026-11-05T02:32:32+00:00","updated_at":"2026-11-05T02:32:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T02:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Yank Note: upgrade to `3.93.1`","reach":"network","title":"Yank Note: terminal handler flaw allows remote OS command injection","impact":"high","summary":"Yank Note, a Markdown note app, has a flaw in its terminal handler's permission check that lets a remote attacker inject operating system commands. The exploit is publicly available, so an attacker can run commands on the machine running the affected version.","audience":"developers","category":"package","nicknames":[],"who_cares":["yank-note","node","electron","terminal"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker runs operating system commands on the host","analyst_note":"Confirm whether the server and terminal feature is on by default and whether authentication is required, using the NVD entry and the linked release notes on github.com.","how_to_check":"- Check the installed Yank Note version in the app or its package metadata; version `3.93.0` is affected.\n- Look for the function `checkPermission` in `src/main/server/index.ts` in your build or source.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Affected is Yank Note 3.93.0, where the terminal handler's checkPermission function in src/main/server/index.ts does not block command injection. Teams that run Yank Note with its server or terminal feature reachable from a network are most exposed. Installations that do not run the server component or that are on 3.93.1 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4312,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122157':13A,16A '-2026':12A,15A '3.93.0':75C '3.93.1':118C '59f85d48f17a70a402ad59dcecacdbec20f954df':128C 'address':119C 'affect':65B,76C,131C 'allow':6A 'app':29B 'attack':44B,56B,101C 'avail':53B,110C 'check':39B 'checkpermiss':83C 'command':9A,48B,59B,98C 'compon':90C,132C 'cve':11A,14A 'electron':17B 'execut':104C 'exploit':50B,107C 'file':86C 'flaw':5A,32B 'function':82C 'handler':4A,36B,92C 'identifi':70C 'inject':10A,45B,99C 'issu':121C 'lead':95C 'let':41B 'machin':62B 'manipul':94C 'markdown':27B 'might':112C 'name':123C 'node':18B 'note':2A,23B,25B,28B,74C 'oper':46B 'os':8A,97C 'packag':19B 'patch':126C 'permiss':38B 'public':52B,109C 'purocean':72C 'recommend':134C 'remot':7A,43B,105C 'run':58B,63B 'src/main/server/index.ts':87C 'system':47B 'termin':3A,20B,35B,91C 'upgrad':115C,129C 'use':114C 'version':66B,117C 'vulner':68C,79C 'yank':1A,22B,24B,73C 'yank-not':21B","nicknames":[],"mitigations":[],"who_affected":"Affected is Yank Note 3.93.0, where the terminal handler's checkPermission function in src/main/server/index.ts does not block command injection. Teams that run Yank Note with its server or terminal feature reachable from a network are most exposed. Installations that do not run the server component or that are on 3.93.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["electron","high","node","package","terminal","yanknote"],"campaign_type":null,"first_public_at":"2026-11-05T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122157","severity":null,"published_at":"2026-11-05T02:16:58+00:00","modified_at":"2026-11-05T02:16:58+00:00","first_seen_at":"2026-11-05T02:31:09+00:00","fetched_at":"2026-11-05T02:31:09+00:00","note":null}],"documents":[{"id":72240,"url":"https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":44179,"url":"https://github.com/purocean/yn/releases/tag/v3.93.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}