Command Injection Vulnerability in VNote Note-Taking Software

CVE-2026-86022

What is CVE-2026-86022?

VNote, a note-taking platform, is vulnerable to command injection due to improper handling of file paths in its external program configuration. In versions prior to 4.3.0, an attacker can exploit this issue by crafting a POSIX note filename that includes an attacker-controlled double quote. This allows the attacker to terminate the quoted path and append additional arguments to the external program’s command, potentially enabling arbitrary command execution under the context of the user running VNote. Users of the software should upgrade to version 4.3.0 or later to mitigate this vulnerability.

References