CVE-2026-126042
VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables
CVSS Score
7.0
EPSS Score
0.0%
EPSS Percentile
0th
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
| CWE | CWE-78 |
| Vendor | vnotex |
| Product | vnote |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for vnotex vnote
Be the first to know when new high vulnerabilities affecting vnotex vnote are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
vnotex / VNote
3.11.0 < 4.12.0
References
github.com: https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918 github.com: https://github.com/vnotex/vnote/releases/tag/v4.12.0 github.com: https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24 github.com: https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56 r3vpwnx.space: https://r3vpwnx.space/research/vnote-tasks-cmdinjection/ vulncheck.com: https://www.vulncheck.com/advisories/vnote-3.11.0-before-4.12.0-os-command-injection-via-tasks-magic-variables
Credits
Dilanka Kaushal Hewage (r3vpwnx)