VNote EUVD-2026-100523

Exploitation requires ALL of the following: (1) a vulnerable VNote install prior to 4.3.0 running on Linux or macOS (Windows is not cited as affected because the double-quote filename vector is POSIX-specific); (2) the victim has configured an external program in SessionConfig::ExternalProgram whose arguments can execute commands - explicitly the vim/gvim '-c' option or an equivalent flag (this is a non-default, user-chosen configuration and the primary limiting factor); (3) an attacker-controlled note whose POSIX filename contains a double quote that terminates the quoted path and appends attacker arguments; and (4) user interaction - the victim must open that note, via either the automatic path (viewareacontroller.cpp openBuffer) or the 'Open With' path (notebooknodecontroller.cpp openNodesWithCommand). The high attack complexity, required user interaction, and dependency on a command-capable external opener substantially limit realistic exploitation despite the full-impact outcome.

This is a genuine but conditional code-execution flaw, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0 High) already tells the real story: full C/I/A impact (arbitrary command execution as the user, CWE-78) but gated behind local attack vector, high attack complexity, and required user interaction. Exploitation is not 'remote and automatic' - it depends on the victim running VNote < 4.3.0 on Linux or macOS AND having configured an external program that accepts a command-executing argument (e.g. vim/gvim -c), which is a non-default, user-specific condition. No EPSS score, SSVC decision data, KEV entry, or public POC was provided in the input, so there is no signal of active or widespread exploitation - consistent with a hard-to-automate, config-dependent client-side bug. Note a minor internal tension: CVSS marks AV:L (local), but the malicious note file could plausibly be delivered over a network (shared/synced notebook) before being opened locally; the 'local' label reflects the point of exploitation (opening the file), not necessarily how the file arrives - verify delivery assumptions against your deployment. Net: a real, patch-worthy High for VNote users, but low practical priority for most fleets given the niche product and the multiple preconditions.

An attacker crafts a note file whose POSIX filename embeds a double quote plus injected arguments (e.g. a filename that closes the quoted path and appends '-c ":!<command>"') and gets it into the victim's VNote notebook. When the victim - who has configured gvim/vim (or another argument-executing program) as an external opener - opens the note automatically or via 'Open With', VNote's fetchCommand reparses the string and passes the injected flags to the program, running arbitrary commands as the user. No public exploit code was identified at time of analysis, and the high complexity plus required user interaction make this a targeted rather than mass-exploitable scenario.