XSS Vulnerability in VNote Note-Taking Platform
CVE-2026-86016

8.2HIGH

Key Information:

Vendor

Vnotex

Status
Vnote
Vendor
CVE Published:
13 October 2026

What is CVE-2026-86016?

VNote, a popular note-taking platform, was found to have a vulnerability that allows malicious Markdown notes to execute stored JavaScript code due to improper sanitization of YAML frontmatter metadata. Users opening compromised notes can inadvertently enable scripts to access local note files and transmit sensitive data to remote servers. This issue has been addressed in version 4.3.0, which implements necessary protections against such attacks.

Affected Version(s)

vnote < 4.3.0

References

https://github.com/vnotex/vnote/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/vnotex/vnote/commit/7371efde531312eb24...
x_refsource_MISC
https://github.com/vnotex/vnote/releases/tag/v4.3.0
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.