{"id":"CVE-2026-86022","summary":"VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling","details":"VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.","aliases":["GHSA-6m2r-wm6v-c8qp"],"modified":"2026-10-15T07:08:47.534802846Z","published":"2026-10-13T19:17:23.321Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-78","CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86022.json"},"references":[{"type":"WEB","url":"https://github.com/vnotex/vnote/releases/tag/v4.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86022.json"},{"type":"ADVISORY","url":"https://github.com/vnotex/vnote/security/advisories/GHSA-6m2r-wm6v-c8qp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86022"},{"type":"FIX","url":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vnotex/vnote","events":[{"introduced":"0"},{"fixed":"4abaacdb8dd110d279f3290ad7e69f20b2604602"},{"fixed":"01f60162d1188b57a1aa9033de7fdf6bb8cf4a9b"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"4.3.0"}]}}],"versions":["v4.2.0","v4.1.1","v4.1.0","continuous-build","v3.20.1","v3.20.0","v3.19.2","v3.19.1","v3.19.0","v3.18.2","v3.18.1","v3.18.0","v3.17.0","v3.16.0","v3.15.1","v3.15.0","v3.14.0","v3.13.1","v3.13.0","v3.12.888","v3.12.0","v3.11.0","3.11.0","v3.10.1","v3.10.0","v3.9.0","v3.8.1","v3.8.0","v3.7.0","v3.6.0","v3.5.1","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.0","v3.0.1","v3.0.0-beta.11","v3.0.0-beta.10","v3.0.0-beta.9","v3.0.0-beta.8","v3.0.0-beta.7","v3.0.0-beta.6","v3.0.0-beta.5","v3.0.0-beta.4","v3.0.0-beta.3","v3.0.0-beta.2","v3.0.0-beta.1","v2.10","v2.9.1","v2.9","v2.8.2","v2.8.1","v2.8","v2.7.2","v2.7.1","v2.7","v2.6","v2.5","v2.4","2.4","v2.3","v2.2","v2.1","v2.0","v1.22","v1.21","v1.20","v1.19","v1.18","v1.17","v1.16","v1.15","v1.14","v1.13","v1.12","v1.11.1","v1.11","v1.10","v1.9","v1.8","v1.7","v1.6","v1.5","v1.4","v1.3","v1.2","v1.1","v1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86022.json","vanir_signatures":[{"id":"CVE-2026-86022-1aef83f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/controllers/viewareacontroller.cpp"},"deprecated":false,"digest":{"line_hashes":["62938935075984933092959035317835534254","262506261924408807849938014915321711281","249715474389919544418390109570598052614","273016609110299078751025387440635714826","243941544373691174125637825825968689109","12049836666172899279390457003385546653","138849013490132552847226601112443050250","211218077563934243336555209336045589569"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"function":"ViewAreaController::openBuffer","file":"src/controllers/viewareacontroller.cpp"},"deprecated":false,"digest":{"length":3195,"function_hash":"24120423865114938971267160601371449006"},"id":"CVE-2026-86022-247497b5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/controllers/notebooknodecontroller.cpp","function":"NotebookNodeController::openNodesWithCommand"},"deprecated":false,"digest":{"function_hash":"198758141833503507874229255082142427998","length":663},"id":"CVE-2026-86022-26f01f4c"},{"source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/core/sessionconfig.cpp"},"deprecated":false,"digest":{"line_hashes":["215859572094849669220057476912643620631","50955052388666820814309310477949236109","39262016362301424327762704306761460039","229539455217159280422162233538236266632","241961658816221397610881468156812586618","155522276775214731437916395416214976943","169565712684793955000590379748319986020","171888571314960608922037681284143560793","178262506447768471654903793720063816538","292174929612737297355735861257900194526","41674590656206261609759969801498276745"],"threshold":0.9},"id":"CVE-2026-86022-3e8ba340","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/controllers/notebooknodecontroller.cpp"},"deprecated":false,"digest":{"line_hashes":["148331729846960793200956781250700966874","120187491921347107983018706271028887630","40518112093630530802053010098128112007","301083705807975112673107250369213978658","276349281923981056961657491755373885138","222192906828987190363500405760675390770","99268203437037796365088692838608655890","237409026592693752122475923835096622626"],"threshold":0.9},"id":"CVE-2026-86022-5b2629b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602"},{"source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"tests/core/test_sessionconfig_extprog.cpp","function":"TestSessionConfigExtProg::testEmptyCommand"},"deprecated":false,"digest":{"length":176,"function_hash":"150061240211490743302375766265968596356"},"id":"CVE-2026-86022-77f3780a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-86022-83f1d11b","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/core/sessionconfig.cpp","function":"SessionConfig::ExternalProgram::fetchCommand"},"deprecated":false,"digest":{"function_hash":"133509384413900924153032711994779725596","length":205}},{"target":{"file":"tests/integration/test_missing_nodes_qt_controller_stubs.cpp"},"deprecated":false,"digest":{"line_hashes":["308912645330730431019530797810460670904","112670159910504616413355453945803694496","287991520559036701277431670932070530170","124259521406438184158156991870987387708"],"threshold":0.9},"id":"CVE-2026-86022-9cb01949","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602"},{"digest":{"line_hashes":["38469157195460535173906503588773789955","131771103443247138135937960798510146581","40275485750363465278734942299173107163","64370950691233824246282214541587479764"],"threshold":0.9},"id":"CVE-2026-86022-a1594f25","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/core/sessionconfig.h"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"tests/core/test_sessionconfig_extprog.cpp"},"deprecated":false,"digest":{"line_hashes":["155655609871946107317556013982283007337","226833255346422342657106693748357273841","247987300915886204177345341868698953797","265746455878084861402572460973439538825","189177622762319266830035453536455354923","303348165644883124162414363876833287367","180295086375878029600767647247265358024","134784924045621611161897986951178744269","201765448256349534929316240754455124740","50779109910178258772768670830944662938","75438923618017674755050461241921430160","94810275158735886169923093642116770978","325111705769604947817794852017665707911","40682425735643057839659826636738479348","90531053421695415994674465171135568491","191522609079315924298845003150043934664"],"threshold":0.9},"id":"CVE-2026-86022-bb5e3b28"},{"digest":{"function_hash":"96941379317635878193014183345488710509","length":218},"id":"CVE-2026-86022-bed1bb32","signature_type":"Function","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"tests/core/test_sessionconfig_extprog.cpp","function":"TestSessionConfigExtProg::testFetchCommand"},"deprecated":false},{"digest":{"line_hashes":["49654700820294266031670750083354747015","291272940530161372516184645581671228157","14581955959111600430537863646283665280"],"threshold":0.9},"id":"CVE-2026-86022-cad6ea9d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602","target":{"file":"src/utils/processutils.h"},"deprecated":false}],"vanir_signatures_modified":"2026-10-15T07:08:47Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}