CVE-2026-86022: VNote: argument injection in external program launch

HIGHCISA: ATTEND

Published October 13, 2026

CISO Take

VNote, a desktop note-taking app, builds a command string around the note path in double quotes and re-parses it, so a note filename containing a double quote can inject extra arguments into the user's configured external program (CWE-78/CWE-88). If that program is vim or gvim, the injected `-c` option executes arbitrary commands as the user. Real-world risk is low to moderate: the vector is local, complexity is high and user interaction is required (CVSS 7.0). There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data. This is a general developer and knowledge-worker tool, not AI-specific, and no AI package in our tracked list is affected. Upgrade to VNote 4.3.0 or later, and be wary of opening notebooks or note folders received from untrusted parties on Linux and macOS.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Overall risk is MEDIUM. The CVSS 7.0 score reflects full confidentiality, integrity and availability impact, offset by local attack vector, high complexity (the victim must have an external program that accepts command-executing arguments) and required user interaction. There is no KEV listing, no known public exploit and no scanner template. Exposure is limited to Linux and macOS users on POSIX filesystems who have configured an external editor such as vim or gvim. The AI link is tenuous: the application is categorized as an AI tool but has no model, inference or agent functionality described in the advisory.

How does the attack unfold?

Initial Access

Attacker delivers a notebook or file with a crafted filename containing a double quote and injected arguments.

AML.T0011

Execution

The victim opens the note in VNote, whose command string is re-parsed and the external program launches with the injected arguments.

AML.T0050

Impact

The editor, such as vim -c, runs arbitrary commands as the user, enabling credential theft or further compromise of the workstation.

Initial Access

Attacker delivers a notebook or file with a crafted filename containing a double quote and injected arguments.

AML.T0011

Execution

The victim opens the note in VNote, whose command string is re-parsed and the external program launches with the injected arguments.

AML.T0050

Impact

The editor, such as vim -c, runs arbitrary commands as the user, enabling credential theft or further compromise of the workstation.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vnote	—	—	No patch

Do you use vnote? You're affected.

How severe is it?

CVSS 3.1

7.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACHigh

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

5 steps

Upgrade VNote to 4.3.0 or later (fix in commit 4abaacd, release v4.3.0).
Until patched, avoid opening notebooks, shared folders or archives from untrusted sources, and avoid the Open With action on files with unusual names.
Consider replacing external programs that accept command-executing options (vim/gvim -c) with ones that do not, or wrap them in a script that treats the path as a single argument.
Detection: look for note or file names containing double quotes or -c sequences in VNote notebooks, and for editor processes spawned by VNote with unexpected arguments in EDR or process-creation telemetry.
Inventory VNote installations on developer endpoints via software asset management.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPluginAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and supply chain risk management

Frequently Asked Questions

What is CVE-2026-86022?

Is CVE-2026-86022 actively exploited?

No confirmed active exploitation of CVE-2026-86022 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86022?

1. Upgrade VNote to 4.3.0 or later (fix in commit 4abaacd, release v4.3.0). 2. Until patched, avoid opening notebooks, shared folders or archives from untrusted sources, and avoid the Open With action on files with unusual names. 3. Consider replacing external programs that accept command-executing options (vim/gvim -c) with ones that do not, or wrap them in a script that treats the path as a single argument. 4. Detection: look for note or file names containing double quotes or ` -c ` sequences in VNote notebooks, and for editor processes spawned by VNote with unexpected arguments in EDR or process-creation telemetry. 5. Inventory VNote installations on developer endpoints via software asset management.

What systems are affected by CVE-2026-86022?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, local note-taking tooling.

What is the CVSS score for CVE-2026-86022?

CVE-2026-86022 has a CVSS v3.1 base score of 7.0 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

developer workstationslocal note-taking tooling

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.

Exploitation Scenario

An attacker shares a notebook or repository, for example a zip of research notes, containing a file whose name embeds a double quote followed by `-c` and a shell command. The victim, an ML engineer who has gvim configured as VNote's external program, opens the note automatically or through Open With. The injected argument causes vim to run attacker-chosen commands as the user. The attacker can then steal API keys, cloud credentials or model files from the workstation.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.