CVE-2026-126042
- Source
- https://cve.org/CVERecord?id=CVE-2026-126042
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126042.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126042
- Published
- 2026-11-10T16:37:43Z
- Modified
- 2026-11-12T07:04:18Z
- Severity
-
- 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables
- Details
-
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-78" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126042.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126042.json
- https://github.com/vnotex/vnote/releases/tag/v4.12.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-126042
- https://r3vpwnx.space/research/vnote-tasks-cmdinjection/
- https://www.vulncheck.com/advisories/vnote-3.11.0-before-4.12.0-os-command-injection-via-tasks-magic-variables
- https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918
- https://github.com/vnotex/vnote
- https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56
- https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24
Affected packages
Git / github.com/vnotex/vnote
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vnotex/vnote
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.11.0" }, { "fixed": "4.12.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "0f5edd837d233a929d2a514a0e718d5d19c93918" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v4.12.0", "range": [ { "fixed": "3d4c806c29de7a01416da5352d22bfe21bc6a128" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
3.*
3.11.0
v3.*
v3.11.0
v3.12.0
v3.12.888
v3.13.0
v3.13.1
v3.14.0
v3.15.0
v3.15.1
v3.16.0
v3.17.0
v3.18.0
v3.18.1
v3.18.2
v3.19.0
v3.19.1
v3.19.2
v3.20.0
v3.20.1
v4.*
v4.1.0
v4.1.1
v4.10.0
v4.11.0
v4.2.0
v4.3.0
v4.4.2
v4.4.3
v4.5.0
v4.6.0
v4.6.1
v4.7.0
v4.8.0
v4.9.0
v4.9.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126042.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "154139029176527466758654403705568940422",
"length": 271
},
"id": "CVE-2026-126042-00096089",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/task.cpp",
"function": "Task::getOptionsShellArgs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313500517948948086459048976239963214210",
"length": 1898
},
"id": "CVE-2026-126042-07ef20ea",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/task.cpp",
"function": "Task::setupProcess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"48556108554194112492588332898668850144",
"66149731547125726736540411196683159684",
"203310338895934431308698196003055963392",
"9682539844065184537933801096626726622",
"40094354441296024298595073374195472364",
"243535731239629600473876791254264979908",
"128206821345282855464414580640230400561",
"277371373157943468615250346336936325764",
"272703743996711119554372375294879977150",
"213216319665783423083087586202889461176",
"11723057666653450532355284845944448733",
"269236613888514575737244820952716504883",
"282996030151919032566242498692197019011",
"47187412004565319473947024380323048622",
"103533584678796419897985586751868565622",
"66255425132412094689310750790716354349",
"214081847403605314102348617639238019021",
"335349498191235401881424782227286909344",
"319768860958027689357727088422850152007",
"261922373424515544909214727358087166267",
"4720536757924106134897806000466449102",
"27633359135819233889990488254996175584",
"42409090243282603679704745306702805",
"104873528054009058018671468124707365767",
"83512353067730490595461723230008340159",
"66097644278692450908533501349138713783",
"297959824029452275790614330689028658828",
"223046252780377779382509160624961464074",
"294245177485948727520561089708437884238",
"325326038327744615796102578806012221320",
"79425384765669803718171143753744002701",
"75293098401462376615453450310412007859",
"128997234667051580417120685309715168490",
"7618761391388983098188712218152893316",
"261431535251828109354219439775971015937",
"147161827217733331295972908225657193678",
"163754994478738257890008081961198602702",
"98517010325198333713518308685949356349",
"57885848060603533616411806245163160088"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-08236da8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "10097873579910366078601841211058970604",
"length": 288
},
"id": "CVE-2026-126042-0af9f3f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.cpp",
"function": "ShellExecution::defaultShellArguments"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "280327934033104875747642017977769928414",
"length": 151
},
"id": "CVE-2026-126042-1703607a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.cpp",
"function": "ShellExecution::quoteSpaces"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166652729980218683111778546717263369500",
"76450572324257955416379652003184049791",
"244193614776362495261585301209224037927",
"151818725488415301245875240208010415965",
"85841361954908193766885143369061632325",
"63537510380774517418536456793405480905",
"142181107302012388181232819853187081735",
"278148017142556844302406475527103429429",
"53836476430133715647625426143194383761"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-2fb3898d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241675123439253288699572283632575891380",
"213053994903676282093589027223786627458",
"316365389119975137433883265618662092971",
"161251790889211295081834842019574027588",
"102713639367994128431040475667023331262",
"117321487348329873936848193354652401286",
"36226112081983718649808616707101912064"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-427b9c52",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/3d4c806c29de7a01416da5352d22bfe21bc6a128",
"target": {
"file": "tests/widgets/test_mindmapeditor.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"317460970620679907348687835682770705416",
"339520189404363046365655378291133243698",
"20408170000768300810909237897964427391",
"233671316232635820756665193918645508569",
"223468913700645532632338261331640659798",
"13541447343833367803470667001582544302",
"106817976292489420145596507709007772108",
"100352129837909788620059486214860432678",
"20087361106894402703776431716830630501",
"29437416028202864781107738186210891316",
"86887363472613079556382257684826260576",
"109602274759746915347394712606631282216",
"158565411299335513046013194028908519495",
"232915203594953130674777190480472752603",
"186181709697276526072124173133167679588",
"257759141513976311767347988814945876500",
"303059060635501631216662636774723779277",
"200232969557388045276010874899490712673",
"42108882775262613204548988501232657972",
"334097448097272780451718248220845171446",
"96638232350568119619145641237912702196",
"233820822690598247614534413508908953244",
"85880607591872972708046975263593542535",
"93575834847573828758044118063586327783",
"268377524646541250821417411997084981196",
"28887294503503370874592506391318685491",
"333079083281412243091982912742091645690",
"222040196437419630141979188735905440420",
"215482654274552989167982460121982562065",
"195497806476718399927657491472824897997",
"308161043190322186511776904428486360369",
"239862556822224097766215438174757086265",
"305817440993783247214351990166074232986",
"266345711232028685546537717189744374263",
"273241841066520653085936365024991178677",
"158208159840060109853080166781310620583"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-48248e68",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/taskvariablemgr.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275422059679626876793198222960557157285",
"length": 598
},
"id": "CVE-2026-126042-546eb1df",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/taskvariablemgr.cpp",
"function": "TaskVariableMgr::initShellVariables"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"310389025808685728024437316541554582950",
"3165864166171366399938572745092082660",
"330232909762065981575141349298696898088"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-78b0dd30",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/taskvariablemgr.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223114692189805654798882952090824610853",
"179925004581492555827718654879115872890",
"203223582932896310641372406910118969330",
"322815694114950966921392085735814240743",
"260761941399645093184423419613756521403",
"103562990005736715649639376557741094680",
"127442302111964155257585283078575152117",
"217108026024178531947290614714595633894",
"11845384331289771638394112800796838360",
"338709308572696655997794897687808620509",
"211020774837356530644849619533885186424",
"189039190798788708222097932675149690168",
"321523003082888600103877551416461440223",
"90416387959998452344625579272810207527",
"114419113703519092282813522069231194251",
"325088730599810787630847649191884250999"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-96e1dd6d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/task.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325031527602578860824067819798309714074",
"length": 188
},
"id": "CVE-2026-126042-9cc6904d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.cpp",
"function": "ShellExecution::quoteSpace"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313609772494668068121600285493151812611",
"length": 511
},
"id": "CVE-2026-126042-d2867be8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/shellexecution.cpp",
"function": "ShellExecution::setupProcess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302390418957707672095676140737397381220",
"95436001325339863320716598936006540661",
"221361175454436650251341196559234180189",
"255676308952330221548516694172899348079"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-d8f1fb0a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/3d4c806c29de7a01416da5352d22bfe21bc6a128",
"target": {
"file": "src/core/configmgr2.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"27904038572166226588423828262986509210",
"308598607529683073577683933120478918878",
"253772456777246900194185836299744608187",
"102705076617926065158483038071506646154",
"327246460554926619745033872504257031801",
"222399106858855119020231008969188683819",
"323510267652647761231546659802302772630",
"165353992504925611637874257108391808494",
"93548967002050867186914769318726094628",
"36930765510091027444599470965575316051",
"63449196623101865923033697055681996502",
"10797148464639574780457269553955646123",
"33197824324013100665238946767493768706",
"163269130693335283937307183369276309625",
"323362188132359879967193411168387065977",
"121234488775289901621949242231761039257",
"215296482149337589300901596673937235905",
"227157858722670372968826725366280463549",
"21701939659662306043235812755499837321",
"223054418396228364662883724360987912399",
"205118647670294248599926495896846750891",
"219119405130168958751825893842367109845",
"142925667979441921248493476475821008745"
],
"threshold": 0.9
},
"id": "CVE-2026-126042-e8a3217c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "tests/core/test_taskservice.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233021300983599691094478336364967715638",
"length": 341
},
"id": "CVE-2026-126042-f9033809",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "tests/core/test_taskservice.cpp",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257664597378714323506791380511977080775",
"length": 725
},
"id": "CVE-2026-126042-fcf3bfd9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918",
"target": {
"file": "src/core/services/taskvariablemgr.cpp",
"function": "TaskVariableMgr::evaluate"
}
}
]
vanir_signatures_modified
"2026-11-12T07:04:18Z"