---
id: "CVE-2026-122157"
kind: "vulnerability"
aliases: ["CVE-2026-122157"]
title: "Yank Note: terminal handler flaw allows remote OS command injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["electron", "node", "package", "terminal", "yank-note"]
not_affected_if: ["default-config"]
published_at: "2026-11-05T02:16:58+00:00"
first_seen_at: "2026-11-05T02:31:09+00:00"
updated_at: "2026-11-05T02:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122157", "first_seen_at": "2026-11-05T02:31:09+00:00"}]
exploit_sources: []
---

# Yank Note: terminal handler flaw allows remote OS command injection

Yank Note, a Markdown note app, has a flaw in its terminal handler's permission check that lets a remote attacker inject operating system commands. The exploit is publicly available, so an attacker can run commands on the machine running the affected version.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Yank Note version in the app or its package metadata; version `3.93.0` is affected.
- Look for the function `checkPermission` in `src/main/server/index.ts` in your build or source.

## Fix

- Yank Note: upgrade to `3.93.1`

## Timeline

- 2026-11-05T02:31:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122157

## Documents

- [fix] Patch: github.com https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df
- [fix] Release notes: github.com https://github.com/purocean/yn/releases/tag/v3.93.1

## From the sources

A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_