CVE-2026-86022
7.0HighPublished 13 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78, CWE-88
Impact
Attackers can achieve arbitrary command execution as the local user if the victim opens a note containing malicious quotes in its filename using a configured external program. This requires local access or tricking the user into opening a maliciously named file.
Root cause
Double-quote wrapping of note filenames fails to prevent argument injection because QProcess reparses the resulting command string into separate arguments.
Affected systems
VNote prior to 4.3.0 on Linux and macOS
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade VNote to version 4.3.0 or later. If updating immediately is not possible, do not open untrusted note files with configured external programs like vim or gvim.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.