CVE-2026-126042
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${
CVSS
7.0
Alta
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-78
Ainda não há histórico EPSS suficiente.
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
- github.comhttps://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56
- github.comhttps://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24
- github.comhttps://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918
- github.comhttps://github.com/vnotex/vnote/releases/tag/v4.12.0
- r3vpwnx.spacehttps://r3vpwnx.space/research/vnote-tasks-cmdinjection/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/vnote-3.11.0-before-4.12.0-os-command-injection-via-tasks-magic-variables
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1229888.0 ALT—
——0Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.3hCVE-2026-1199067.8 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.3hCVE-2026-1094578.0 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.3hCVE-2026-1022248.4 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.3hCVE-2026-1054257.2 ALT—
——0OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.4hCVE-2026-123717——
——0OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.10h