Description
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
Published: 2026-11-10
Score: 7.3 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Description VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
Title VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables
First Time appeared Vnote Project
Vnote Project vnote
Weaknesses CWE-78
CPEs cpe:2.3:a:vnote_project:vnote:*:*:*:*:*:*:*:*
Vendors & Products Vnote Project
Vnote Project vnote
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Vnote Project Vnote
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-10T21:04:29.318Z

Reserved: 2026-11-10T16:35:32.223Z

Link: CVE-2026-126042

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-10T17:17:31.303

Modified: 2026-11-10T21:19:23.837

Link: CVE-2026-126042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')