CVE-2026-86016 Details
Description
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.
A stored cross-site scripting vulnerability has been identified in VNote versions prior to 4.3.0. The issue arises from the unsafe handling of YAML frontmatter metadata, which is inserted into the DOM using 'innerHTML' without proper sanitization. This vulnerability allows executed JavaScript to bypass the application's XSS protection and run in the context of the file viewer. Exploitation of this vulnerability enables the reading of local note files and the exfiltration of their contents to a remote server, all without requiring additional user interaction.
Users can update to VNote version 4.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vnotex/vnote/security/advisories/GHSA-vfhj-c636-h59x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/vnotex/vnote/commit/7371efde531312eb24beb982fb5fdd73469cb171 | [email protected] | Source CodeVendor |
| https://github.com/vnotex/vnote/releases/tag/v4.3.0 | [email protected] | Release NotesVendor |
| https://github.com/vnotex/vnote/security/advisories/GHSA-vfhj-c636-h59x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VNote | 3.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |