CVE-2026-126042: VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables

Published Nov 10, 2026

Updated

VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.

Event History

Nov 10, 2026

CVE Published

via MITRE·04:37 PM

Data Sourced

via MITRE·04:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of VNote versions from 3.11.0 up to, but not including, 4.12.0 are exposed if they run a Task that references magic variables such as ${bufferName} or ${selectedText} while handling attacker-controlled note names or note text.

What must an attacker do to trigger exploitation?

An attacker needs to get a victim to open or otherwise use a shared notebook containing a malicious filename or text, then have the victim run a Task that inserts the affected magic variable into a shell command. Exploitation requires user interaction.

What is the immediate mitigation if upgrading is not possible?

Do not run Tasks that use ${bufferName}, ${selectedText}, or other affected magic-variable substitutions with untrusted notebooks or notes. Treat shared note filenames and note contents as potentially hostile, especially when they include shell metacharacters such as $(...), backticks, semicolons, or pipes.

How can I determine whether a system may be affected?

Check whether the installed VNote version is earlier than 4.12.0 and at least 3.11.0. Review configured Tasks for shell command strings that reference ${bufferName} or ${selectedText}, and identify whether those tasks were run against shared or untrusted note content.

CVE-2026-126042: VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger exploitation?

What is the immediate mitigation if upgrading is not possible?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger exploitation?

What is the immediate mitigation if upgrading is not possible?

How can I determine whether a system may be affected?