# CVE-2026-86022: VNote external program argument injection

Source: https://junglewise.ai/threats/cve-2026-86022-vnote-is-a-note-taking-platform-prior-to-4-3-0-sessionconfig  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86022 · Severity: high · CVSS 7 · Published 2026-10-13

VNote is a note-taking application that allows users to open notes with external programs of their choice. Prior to version 4.3.0, an attacker could create a note with a specially crafted filename containing quote characters to inject additional arguments into the configured external program. If that program supports command execution (such as vim), an attacker could achieve arbitrary code execution on the user's system.

Technologies: [Vnotex vNote](https://junglewise.ai/threats/technologies/vnote). Vendors: [Vnotex](https://junglewise.ai/threats/vendors/vnotex).

## Quick answers

**Is CVE-2026-86022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86022 being exploited in the wild.

**How severe is CVE-2026-86022?** High severity, with a CVSS score of 7, published 13 October 2026.

**Which products and versions are affected?** Vnotex vNote before 4.3.0.

**Is there a fix for CVE-2026-86022?** Yes: fixed in 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86022 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-86022?** Check whether you run Vnotex vNote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.3.0

## Technical details

SessionConfig::ExternalProgram::fetchCommand wraps note paths in double quotes and substitutes them into a command string that QProcess::start reparses into arguments, allowing argument injection via quote characters in filenames on Linux and macOS. The vulnerability exists in both the automatic-path feature (viewareacontroller.cpp) and the Open With feature (notebooknodecontroller.cpp). An attacker-controlled double quote in a POSIX filename can terminate the quoted path and inject arguments to execute commands through programs like vim with the -c option.

## Affected products

- vnotex VNote before 4.3.0

## Timeline

- 2026-10-13: disclosed: Published on NVD
- 2026-07-19: patched: Fix committed to master

## References

- [https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602](https://github.com/vnotex/vnote/commit/4abaacdb8dd110d279f3290ad7e69f20b2604602)
- [https://github.com/vnotex/vnote/releases/tag/v4.3.0](https://github.com/vnotex/vnote/releases/tag/v4.3.0)

## Related threats

- [VNote stored XSS in YAML frontmatter](https://junglewise.ai/threats/cve-2026-86016-vnote-is-a-note-taking-platform-prior-to-4-3-0-vnote-uses-the)
- [vnotex vNote cross-site scripting in YAML Frontmatter](https://junglewise.ai/threats/cve-2026-15505-vnotex-vnote-cross-site-scripting-in-yaml-frontmatter)