The vulnerability is a persistent Cross‑Site Scripting flaw in Anote 1.0 that permits an attacker to embed malicious JavaScript within markdown files stored by the application. By creating a specially crafted markdown file, the attacker can trigger the execution of arbitrary system commands when a user opens the file. The flaw is based on CWE‑79 and results in remote code execution on the victim’s machine.

AnotherNote’s Anote version 1.0 is affected. The flaw resides in the handling of markdown content that is stored and later rendered by the application. No other product variants or versions are listed in the CNA data.

The CVSS score of 5.1 indicates a moderate severity, but the risk is amplified by the RCE impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so there are no known active exploits yet. Likely the attack vector involves uploading a malicious markdown file to the application, then having a legitimate user open it. Successful exploitation requires the victim to view the file, which means the threat is limited to users with access to the affected application.