Vnotex vulnerabilities
We track 5 vulnerabilities in Vnotex products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Vnotex vulnerabilities
- 7.0 High severity
VNote: Improper Neutralization of Special Elements used in an OS Command
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a
- 7.0 High severity
vnote: Improper Neutralization of Special Elements used in an OS Command
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDe
- 8.2 High severity
vnote: Improper Neutralization of Input During Web Page Generation
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening
- 9.6 Critical severity
vnote: Improper Neutralization of Input During Web Page Generation
VNote is a note-taking platform. A Cross-Site Scripting (XSS) vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and prior of the VNote note-taking application. This vulnerability allows the injection and execution of
- 8.8 High severity
vnote: External Control of File Name or Path
VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a li