CVE-2026-86016: VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = pmetaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VNoteto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running VNote versions before 4.3.0 are exposed if they open an attacker-supplied Markdown note containing malicious YAML frontmatter.
What does an attacker need to exploit this issue?
The attacker needs to provide a crafted Markdown note and convince a user to open it. No attacker authentication or additional interaction is required after the note is opened.
What data could be exposed?
JavaScript executing in the file:// viewer context can read reachable local note files and send their contents to a remote server. The described impact includes high confidentiality impact and limited integrity impact.
What should be done if patching is not immediately possible?
Do not open Markdown notes from untrusted sources, particularly files with YAML frontmatter, until VNote can be updated. The issue is fixed in VNote 4.3.0.