Executive brief
Anote is an open-source note-taking application that supports Markdown. A security flaw allows attackers to create malicious note files that, when opened, can take control of a user's computer. This could lead to the theft of sensitive files or the installation of unauthorized software.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Anote 1.0 due to improper neutralization of input during Markdown rendering. By embedding malicious JavaScript within a Markdown (.md) file, an attacker can trigger the execution of system commands via the underlying Electron/Node.js environment when the file is opened or viewed within the application. This vulnerability effectively escalates from XSS to Remote Code Execution (RCE) because the application does not sufficiently isolate the web-based frontend from the system-level backend. Exploitation can occur if a user imports or opens a specially crafted Markdown file provided by an attacker.
Affected products
- AnotherNote Anote 1.0
Timeline
- 2021-05-04: disclosed: Initial exploit published on Exploit-DB
- 2026-05-15: advisory: NVD and VulnCheck published formal advisory details