Is CVE-2026-122157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122157 being exploited in the wild.

How severe is CVE-2026-122157?

Medium severity, with a CVSS score of 6.3, published 5 November 2026.

Is there a fix for CVE-2026-122157?

Yes: fixed in 3.93.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122157 attacked?

It is attacked over the network or with local access, in a network appliance.

Am I affected by CVE-2026-122157?

Check whether you run Purocean Yank Note at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122157: Purocean Yank Note OS command injection in Terminal Handler

CVE-2026-122157 · Severity: medium · CVSS 6.3 · Published 2026-11-05

Yank Note, a note-taking application for Electron desktops, exposes an unauthenticated WebSocket endpoint that grants arbitrary shell command execution with the privileges of the logged-in user. Any web page visited on the same machine can connect to the local terminal interface and run commands, read output, and steal files or credentials. This is effectively a remote code execution vulnerability with zero user interaction required.

Technologies: Purocean Yank Note. Vendors: Purocean.

Quick answers

Is CVE-2026-122157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122157 being exploited in the wild.
How severe is CVE-2026-122157?: Medium severity, with a CVSS score of 6.3, published 5 November 2026.
Which products and versions are affected?: Purocean Yank Note 3.93.0.
Is there a fix for CVE-2026-122157?: Yes: fixed in 3.93.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122157 attacked?: It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2026-122157?: Check whether you run Purocean Yank Note at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.93.1

Technical details

The vulnerability combines two flaws in src/main/server/index.ts: (1) the checkPermission() function grants admin role to unauthenticated loopback requests without token validation, and (2) the /ws Socket.IO namespace exposes a node-pty shell with no authentication or Origin validation during handshake. An attacker on the local machine can establish a WebSocket connection via browser or script, send commands through the input event, and receive output through the output event, gaining an interactive shell running as the user.

Affected products

Purocean Yank Note 3.93.0

Timeline

2026-10-03: disclosed
2026-10-07: patched
2026-11-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.