CVE-2026-126042 · Package
NO FIX YET · SEE WHAT TO DO
VNote, a desktop Markdown note app, substitutes note filenames and selected text into a shell command in its Tasks feature without escaping. A crafted note in a shared notebook can run arbitrary commands as the victim when they run a task that uses those variables.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running VNote from 3.11.0 before 4.12.0 who opens notebooks from others and runs a Tasks entry that uses the magic variables. The exposure depends on running a task on a note with crafted filename or text; users who only write their own notes and never run shared tasks are less exposed.
Not affected if no-tasks-used, own-notes-only, version-4.12.0-or-later
Who cares desktop, markdown, vnote
${bufferName} or ${selectedText}.4.12.0 or later.VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.