CVE-2026-86016

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.

• CWE-79

• https://github.com/vnotex/vnote/commit/7371efde531312eb24beb982fb5fdd73469cb171
• https://github.com/vnotex/vnote/releases/tag/v4.3.0
• https://github.com/vnotex/vnote/security/advisories/GHSA-vfhj-c636-h59x
• https://github.com/vnotex/vnote/security/advisories/GHSA-vfhj-c636-h59x

Published

Oct 13, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85999Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86000Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86002Dokku is a docker-powered platform as a service. In Dokku ve…9
• CVE-2026-86003CoreDNS is a DNS server written in Go. Prior to 1.14.7, the …7.5
• CVE-2026-86008Mailu is a mail server distributed as a set of Docker images…7.2
• CVE-2026-86009Mailu is a mail server distributed as a set of Docker images…8.2
• CVE-2026-86018Part-DB is an open source inventory management system for el…5.3
• CVE-2026-86019Part-DB is an open source inventory management system for el…5.3
• CVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Criti…9.1
• CVE-2026-86020Part-DB is an open source inventory management system for el…4.6
• CVE-2026-86022VNote is a note-taking platform. Prior to 4.3.0, SessionConf…7
• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8