{"id":"CVE-2026-126042","summary":"VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables","details":"VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.","modified":"2026-11-12T07:04:18.439066210Z","published":"2026-11-10T16:37:43.934Z","database_specific":{"cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126042.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126042.json"},{"type":"ADVISORY","url":"https://github.com/vnotex/vnote/releases/tag/v4.12.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126042"},{"type":"ADVISORY","url":"https://r3vpwnx.space/research/vnote-tasks-cmdinjection/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vnote-3.11.0-before-4.12.0-os-command-injection-via-tasks-magic-variables"},{"type":"FIX","url":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918"},{"type":"PACKAGE","url":"https://github.com/vnotex/vnote"},{"type":"ARTICLE","url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56"},{"type":"ARTICLE","url":"https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vnotex/vnote","events":[{"introduced":"126091c080fb5685f7cdc4e4e05799d4482826e8"},{"fixed":"3d4c806c29de7a01416da5352d22bfe21bc6a128"},{"fixed":"0f5edd837d233a929d2a514a0e718d5d19c93918"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.11.0"},{"fixed":"4.12.0"}]},{"range":[{"fixed":"0f5edd837d233a929d2a514a0e718d5d19c93918"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v4.12.0","range":[{"fixed":"3d4c806c29de7a01416da5352d22bfe21bc6a128"}]}]}}],"versions":["v4.11.0","v4.10.0","v4.9.1","v4.9.0","v4.8.0","v4.7.0","v4.6.1","v4.6.0","v4.5.0","v4.4.3","v4.4.2","v4.3.0","v4.2.0","v4.1.1","v4.1.0","v3.20.1","v3.20.0","v3.19.2","v3.19.1","v3.19.0","v3.18.2","v3.18.1","v3.18.0","v3.17.0","v3.16.0","v3.15.1","v3.15.0","v3.14.0","v3.13.1","v3.13.0","v3.12.888","v3.12.0","v3.11.0","3.11.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126042.json","vanir_signatures":[{"target":{"function":"Task::getOptionsShellArgs","file":"src/core/services/task.cpp"},"deprecated":false,"digest":{"function_hash":"154139029176527466758654403705568940422","length":271},"id":"CVE-2026-126042-00096089","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918"},{"id":"CVE-2026-126042-07ef20ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/task.cpp","function":"Task::setupProcess"},"deprecated":false,"digest":{"function_hash":"313500517948948086459048976239963214210","length":1898}},{"deprecated":false,"digest":{"line_hashes":["48556108554194112492588332898668850144","66149731547125726736540411196683159684","203310338895934431308698196003055963392","9682539844065184537933801096626726622","40094354441296024298595073374195472364","243535731239629600473876791254264979908","128206821345282855464414580640230400561","277371373157943468615250346336936325764","272703743996711119554372375294879977150","213216319665783423083087586202889461176","11723057666653450532355284845944448733","269236613888514575737244820952716504883","282996030151919032566242498692197019011","47187412004565319473947024380323048622","103533584678796419897985586751868565622","66255425132412094689310750790716354349","214081847403605314102348617639238019021","335349498191235401881424782227286909344","319768860958027689357727088422850152007","261922373424515544909214727358087166267","4720536757924106134897806000466449102","27633359135819233889990488254996175584","42409090243282603679704745306702805","104873528054009058018671468124707365767","83512353067730490595461723230008340159","66097644278692450908533501349138713783","297959824029452275790614330689028658828","223046252780377779382509160624961464074","294245177485948727520561089708437884238","325326038327744615796102578806012221320","79425384765669803718171143753744002701","75293098401462376615453450310412007859","128997234667051580417120685309715168490","7618761391388983098188712218152893316","261431535251828109354219439775971015937","147161827217733331295972908225657193678","163754994478738257890008081961198602702","98517010325198333713518308685949356349","57885848060603533616411806245163160088"],"threshold":0.9},"id":"CVE-2026-126042-08236da8","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/shellexecution.cpp"}},{"digest":{"length":288,"function_hash":"10097873579910366078601841211058970604"},"id":"CVE-2026-126042-0af9f3f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/shellexecution.cpp","function":"ShellExecution::defaultShellArguments"},"deprecated":false},{"digest":{"length":151,"function_hash":"280327934033104875747642017977769928414"},"id":"CVE-2026-126042-1703607a","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/shellexecution.cpp","function":"ShellExecution::quoteSpaces"},"deprecated":false},{"digest":{"line_hashes":["166652729980218683111778546717263369500","76450572324257955416379652003184049791","244193614776362495261585301209224037927","151818725488415301245875240208010415965","85841361954908193766885143369061632325","63537510380774517418536456793405480905","142181107302012388181232819853187081735","278148017142556844302406475527103429429","53836476430133715647625426143194383761"],"threshold":0.9},"id":"CVE-2026-126042-2fb3898d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/shellexecution.h"},"deprecated":false},{"source":"https://github.com/vnotex/vnote/commit/3d4c806c29de7a01416da5352d22bfe21bc6a128","target":{"file":"tests/widgets/test_mindmapeditor.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["241675123439253288699572283632575891380","213053994903676282093589027223786627458","316365389119975137433883265618662092971","161251790889211295081834842019574027588","102713639367994128431040475667023331262","117321487348329873936848193354652401286","36226112081983718649808616707101912064"]},"id":"CVE-2026-126042-427b9c52","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["317460970620679907348687835682770705416","339520189404363046365655378291133243698","20408170000768300810909237897964427391","233671316232635820756665193918645508569","223468913700645532632338261331640659798","13541447343833367803470667001582544302","106817976292489420145596507709007772108","100352129837909788620059486214860432678","20087361106894402703776431716830630501","29437416028202864781107738186210891316","86887363472613079556382257684826260576","109602274759746915347394712606631282216","158565411299335513046013194028908519495","232915203594953130674777190480472752603","186181709697276526072124173133167679588","257759141513976311767347988814945876500","303059060635501631216662636774723779277","200232969557388045276010874899490712673","42108882775262613204548988501232657972","334097448097272780451718248220845171446","96638232350568119619145641237912702196","233820822690598247614534413508908953244","85880607591872972708046975263593542535","93575834847573828758044118063586327783","268377524646541250821417411997084981196","28887294503503370874592506391318685491","333079083281412243091982912742091645690","222040196437419630141979188735905440420","215482654274552989167982460121982562065","195497806476718399927657491472824897997","308161043190322186511776904428486360369","239862556822224097766215438174757086265","305817440993783247214351990166074232986","266345711232028685546537717189744374263","273241841066520653085936365024991178677","158208159840060109853080166781310620583"],"threshold":0.9},"id":"CVE-2026-126042-48248e68","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/taskvariablemgr.cpp"}},{"target":{"file":"src/core/services/taskvariablemgr.cpp","function":"TaskVariableMgr::initShellVariables"},"deprecated":false,"digest":{"function_hash":"275422059679626876793198222960557157285","length":598},"id":"CVE-2026-126042-546eb1df","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918"},{"target":{"file":"src/core/services/taskvariablemgr.h"},"deprecated":false,"digest":{"line_hashes":["310389025808685728024437316541554582950","3165864166171366399938572745092082660","330232909762065981575141349298696898088"],"threshold":0.9},"id":"CVE-2026-126042-78b0dd30","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918"},{"source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/task.cpp"},"deprecated":false,"digest":{"line_hashes":["223114692189805654798882952090824610853","179925004581492555827718654879115872890","203223582932896310641372406910118969330","322815694114950966921392085735814240743","260761941399645093184423419613756521403","103562990005736715649639376557741094680","127442302111964155257585283078575152117","217108026024178531947290614714595633894","11845384331289771638394112800796838360","338709308572696655997794897687808620509","211020774837356530644849619533885186424","189039190798788708222097932675149690168","321523003082888600103877551416461440223","90416387959998452344625579272810207527","114419113703519092282813522069231194251","325088730599810787630847649191884250999"],"threshold":0.9},"id":"CVE-2026-126042-96e1dd6d","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/shellexecution.cpp","function":"ShellExecution::quoteSpace"},"deprecated":false,"digest":{"function_hash":"325031527602578860824067819798309714074","length":188},"id":"CVE-2026-126042-9cc6904d","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-126042-d2867be8","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"function":"ShellExecution::setupProcess","file":"src/core/services/shellexecution.cpp"},"deprecated":false,"digest":{"function_hash":"313609772494668068121600285493151812611","length":511}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["302390418957707672095676140737397381220","95436001325339863320716598936006540661","221361175454436650251341196559234180189","255676308952330221548516694172899348079"]},"id":"CVE-2026-126042-d8f1fb0a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/3d4c806c29de7a01416da5352d22bfe21bc6a128","target":{"file":"src/core/configmgr2.cpp"}},{"deprecated":false,"digest":{"line_hashes":["27904038572166226588423828262986509210","308598607529683073577683933120478918878","253772456777246900194185836299744608187","102705076617926065158483038071506646154","327246460554926619745033872504257031801","222399106858855119020231008969188683819","323510267652647761231546659802302772630","165353992504925611637874257108391808494","93548967002050867186914769318726094628","36930765510091027444599470965575316051","63449196623101865923033697055681996502","10797148464639574780457269553955646123","33197824324013100665238946767493768706","163269130693335283937307183369276309625","323362188132359879967193411168387065977","121234488775289901621949242231761039257","215296482149337589300901596673937235905","227157858722670372968826725366280463549","21701939659662306043235812755499837321","223054418396228364662883724360987912399","205118647670294248599926495896846750891","219119405130168958751825893842367109845","142925667979441921248493476475821008745"],"threshold":0.9},"id":"CVE-2026-126042-e8a3217c","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"tests/core/test_taskservice.cpp"}},{"digest":{"function_hash":"233021300983599691094478336364967715638","length":341},"id":"CVE-2026-126042-f9033809","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"tests/core/test_taskservice.cpp","function":"main"},"deprecated":false},{"id":"CVE-2026-126042-fcf3bfd9","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918","target":{"file":"src/core/services/taskvariablemgr.cpp","function":"TaskVariableMgr::evaluate"},"deprecated":false,"digest":{"function_hash":"257664597378714323506791380511977080775","length":725}}],"vanir_signatures_modified":"2026-11-12T07:04:18Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}