{"id":"CVE-2026-126042","published":"2026-11-10T17:17:31.303","lastModified":"2026-11-10T21:19:23.837","description":"VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.","cvssScore":7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56","tags":[]},{"url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24","tags":[]},{"url":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","tags":[]},{"url":"https://github.com/vnotex/vnote/releases/tag/v4.12.0","tags":[]},{"url":"https://r3vpwnx.space/research/vnote-tasks-cmdinjection/","tags":[]},{"url":"https://www.vulncheck.com/advisories/vnote-3.11.0-before-4.12.0-os-command-injection-via-tasks-magic-variables","tags":[]}],"exploitRefs":[{"url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56","tags":[]},{"url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24","tags":[]},{"url":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","tags":[]},{"url":"https://github.com/vnotex/vnote/releases/tag/v4.12.0","tags":[]}],"hasPoc":true,"ai":null}