CVE-2026-122157 Details

A command injection vulnerability has been identified in Purocean Yank Note version 3.93.0. The issue arises in the Terminal Handler component, specifically within the checkPermission function of the file src/main/server/index.ts. This vulnerability allows for operating system command injection, which can be executed remotely. The exploitation takes advantage of an exposed WebSocket endpoint that lacks authentication and proper origin validation, enabling any connected client to send commands that are executed on the server. The output of these commands is then returned to the client, creating an interactive shell. This vulnerability is particularly critical as it bypasses normal authentication mechanisms and could be exploited by simply visiting a malicious website while the application is running.

Users are advised to update to Purocean Yank Note version 3.93.1, which addresses this vulnerability by implementing origin validation and requiring JSON bodies for API requests.