CVE-2026-86022 in VNote
Summary
by MITRE • 10/13/2026
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in VNote prior to version 4.3.0 represents a classic command injection flaw rooted in improper handling of external program execution parameters within the application's note-taking workflow. The core technical defect resides in the SessionConfig::ExternalProgram::fetchCommand function, which is responsible for constructing shell commands that launch external applications associated with specific notes. When preparing these commands, the system wraps the file path of the target note in double quotes and substitutes it directly into a command string template. This constructed string is then passed to QProcess::start(const QString&) on Linux and macOS systems, where it undergoes further parsing by ProcessUtils::startDetached to separate arguments for execution. The critical failure occurs because the input validation does not adequately sanitize or escape special characters within the note filename before inclusion in the command structure.
An attacker who can control the name of a note file stored on the victim's system, specifically one containing double quote characters, can exploit this parsing behavior to break out of the intended argument boundary. On POSIX-compliant systems like Linux and macOS, shell-like parsers interpret unescaped double quotes as delimiters for string arguments. By inserting a closing double quote into the filename, an attacker effectively terminates the quoted path segment that was meant to protect spaces or special characters in legitimate filenames. This allows subsequent content within the filename to be interpreted not as part of the file path, but as additional command-line arguments passed to the external program configured by the user for opening notes.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution under the context of the logged-in user. Once the attacker successfully injects extra arguments into the command line, they can leverage features of commonly used text editors or viewers that accept executable commands as parameters. For instance, if a victim has configured vim or gvim as their external editor, these applications support flags such as -c which allow for the execution of arbitrary Vimscript commands upon launch. By injecting an argument like "-c :system(echo pwned)" into the filename string, the attacker can force the application to execute system-level shell commands when the note is opened. This results in remote code execution without any need for user interaction beyond opening the maliciously named file, effectively bypassing standard security boundaries within the local environment.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code or Commands. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, specifically through indirect command execution via application parameters rather than direct shell access. The attack vector is primarily local but can be facilitated remotely if an attacker can trick a user into opening a file with a crafted name, such as through phishing emails or malicious downloads that place the note in a directory monitored by VNote.
Mitigation for this vulnerability requires strict input validation and output encoding practices within the application codebase. Developers must ensure that any external data used to construct system commands is properly escaped or quoted according to shell-specific rules before being passed to process execution functions. In the context of Qt applications, using QProcess::start(const QStringList &arguments) instead of parsing a single string command can prevent such injection attacks by treating each argument as a distinct entity rather than relying on shell-based tokenization. The issue was resolved in VNote version 4.3.0 through these hardening measures, ensuring that special characters in filenames are safely handled without altering the intended structure of external program arguments. Users running versions prior to this release should upgrade immediately or avoid opening notes from untrusted sources until patched.