CVE-2026-86022: VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VNoteto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Which systems and configurations are exposed?
The issue affects VNote versions before 4.3.0 on Linux and macOS when an external program is configured to open notes. Exploitation additionally depends on that program accepting an argument capable of executing commands, such as the -c option in vim or gvim.
What must an attacker do to exploit this?
An attacker needs to cause the victim to open a note whose POSIX filename contains a double quote. Opening the note through either the automatic external-program path or the Open With path can pass injected arguments to the configured external program.
Are users affected by default?
The provided information identifies exposure through configured external-program handling, but does not state whether a command-executing external program is configured by default. Systems without a relevant external-program configuration are not described as exploitable.
What can be done before upgrading?
Avoid opening untrusted notes with attacker-controlled filenames through external-program or Open With handling, especially where the configured program supports command-executing arguments. Upgrade VNote to version 4.3.0 to obtain the fix.