# CVE-2026-122157: Purocean Yank Note OS command injection in Terminal Handler

Source: https://junglewise.ai/threats/cve-2026-122157-a-vulnerability-was-identified-in-purocean-yank-note-3-93-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-122157 · Severity: medium · CVSS 6.3 · Published 2026-11-05

Yank Note, a note-taking application for Electron desktops, exposes an unauthenticated WebSocket endpoint that grants arbitrary shell command execution with the privileges of the logged-in user. Any web page visited on the same machine can connect to the local terminal interface and run commands, read output, and steal files or credentials. This is effectively a remote code execution vulnerability with zero user interaction required.

Technologies: [Purocean Yank Note](https://junglewise.ai/threats/technologies/yank-note). Vendors: [Purocean](https://junglewise.ai/threats/vendors/purocean).

## Quick answers

**Is CVE-2026-122157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122157 being exploited in the wild.

**How severe is CVE-2026-122157?** Medium severity, with a CVSS score of 6.3, published 5 November 2026.

**Which products and versions are affected?** Purocean Yank Note 3.93.0.

**Is there a fix for CVE-2026-122157?** Yes: fixed in 3.93.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122157 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-122157?** Check whether you run Purocean Yank Note at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.93.1

## Technical details

The vulnerability combines two flaws in src/main/server/index.ts: (1) the checkPermission() function grants admin role to unauthenticated loopback requests without token validation, and (2) the /ws Socket.IO namespace exposes a node-pty shell with no authentication or Origin validation during handshake. An attacker on the local machine can establish a WebSocket connection via browser or script, send commands through the input event, and receive output through the output event, gaining an interactive shell running as the user.

## Affected products

- Purocean Yank Note 3.93.0

## Timeline

- 2026-10-03: disclosed
- 2026-10-07: patched
- 2026-11-05: advisory

## References

- [https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df](https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df)
- [https://github.com/purocean/yn/issues/531](https://github.com/purocean/yn/issues/531)

## Related threats

- [purocean Yank Note JWT signing key disclosure](https://junglewise.ai/threats/cve-2026-122154-a-vulnerability-was-found-in-purocean-yank-note-3-93-0-this)
- [Yank Note path traversal via /api/help](https://junglewise.ai/threats/cve-2026-111915-yank-note-before-3-93-1-contains-a-path-traversal-vulnerability)