# CVE-2026-126042: VNote OS command injection in Tasks feature

Source: https://junglewise.ai/threats/cve-2026-126042-vnote-3-11-0-before-4-12-0-contains-an-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126042 · Severity: high · CVSS 7 · Published 2026-11-10

VNote is a note-taking application with a Tasks feature that allows running commands on note data. The Tasks feature fails to properly escape shell metacharacters in magic variables like ${bufferName} and ${selectedText}, allowing attackers to execute arbitrary OS commands as the victim by sharing malicious notebooks.

## Quick answers

**Is CVE-2026-126042 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126042 being exploited in the wild.

**How severe is CVE-2026-126042?** High severity, with a CVSS score of 7, published 10 November 2026.

**Which products and versions are affected?** VNote 3.11.0 before 4.12.0.

**Is there a fix for CVE-2026-126042?** Yes: fixed in 4.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126042 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126042?** Check whether you run VNote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.12.0

## Technical details

The vulnerability is an OS command injection in the Tasks feature where magic variables are substituted into shell command strings without escaping. Attackers can craft notebook notes with filenames or text containing shell metacharacters ($(...), backticks, semicolons, pipes) that are interpolated unsanitized into bash -c commands. Exploitation requires user interaction: the victim must open a malicious notebook and execute a task that references the injected variables.

## Affected products

- VNote 3.11.0 before 4.12.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp](https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp)
- [https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp](https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp)