CVE-2026-86016
8.2HighPublished 13 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality
- Weakness
- CWE-79
Impact
Attackers can read and exfiltrate local files by tricking a user into opening a malicious Markdown note. The payload executes stored JavaScript in the local viewer context and transmits data to an external server.
Root cause
YAML frontmatter metadata is assigned directly to innerHTML before XSS sanitization runs, combined with QWebEngineSettings allowing local content to access remote URLs.
Affected systems
VNote prior to 4.3.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Fix & remediation
Upgrade VNote to version 4.3.0 or later. If upgrading immediately is not possible, do not open untrusted Markdown files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.