EUVD-2026-43246
GHSA-q2vg-w96j-jgp7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS via shared note requires low privileges to craft and deliver, user interaction to render, scope change to browser context, with low confidentiality and integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component YAML Frontmatter. This manipulation of the argument p_metaData causes cross site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in vnotex vnote up to version 3.20.1 allows a remote attacker with low-level privileges to inject malicious scripts via the YAML frontmatter p_metaData argument processed by /src/data/extra/web/js/markdownit.js. When a victim views or renders a specially crafted note containing malicious YAML metadata, the injected script executes in their browser context, enabling limited integrity manipulation. No patch is available at time of analysis - the vendor did not respond to responsible disclosure contact - and exploit code is publicly referenced via VulDB.
Technical ContextAI
vnote (cpe:2.3:a:vnotex:vnote:*:*:*:*:*:*:*:*) is a Markdown-based note-taking application that uses the markdownit JavaScript library to render notes in a web view. The vulnerable component is the YAML frontmatter parser in /src/data/extra/web/js/markdownit.js, which processes structured metadata blocks at the top of Markdown files. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the application fails to sanitize or encode user-controlled input in the p_metaData argument before rendering it as HTML, allowing script injection. This is a classic stored or reflected XSS pattern within a desktop application's embedded web renderer, where the attack surface is the note's YAML header block.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure contact. Users should treat all vnote versions up to 3.20.1 as unpatched. As a compensating control, avoid opening notes received from untrusted or unknown sources, since exploitation requires viewing a crafted note. Where collaborative note-sharing is used, restrict sharing to trusted parties and disable or review YAML frontmatter usage in shared notebooks. Organizations using vnote in multi-user environments should consider migrating to a note-taking solution with active security support until a patched vnote release is published. Monitor https://vuldb.com/vuln/377834 and the vnotex GitHub repository for any upstream fix. The trade-off of disabling YAML frontmatter processing (if configurable) eliminates the attack surface but also removes metadata-based features such as note tagging and templating.
VNote is a note-taking platform. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no auth
A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Rated medium severity (CVSS 6
VNote 2.2 has XSS via a new text note. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today