Description
A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
Published: 2026-11-05
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the checkPermission function of the Terminal Handler in version 3.93.0 of Purocean Yank Note. It allows an attacker to inject arbitrary OS commands, leading to remote command execution. The weakness aligns with CWE-77 and CWE-78, indicating that unsanitized input is being passed directly to the operating system. The impact permits an attacker to execute commands with the privileges of the application.

Affected Systems

All installations of Purocean Yank Note 3.93.0 are affected. The vendor has released patch version 3.93.1, containing the patch commit 59f85d48f17a70a402ad59dcecacdbec20f954df, which resolves the issue.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability in the moderate range. EPSS data is not available, but the vulnerability is publicly exploitable, suggesting a realistic threat. The attack vector is remote, and the exploit is available in public repositories. As the vulnerability is not listed in CISA KEV, it is not part of a catalog of known exploited vulnerabilities, but administrators should still prioritize remediation because of its remote command execution capability.

Generated by OpenCVE AI on November 5, 2026 at 03:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Purocean Yank Note version 3.93.1 or later, which contains the fix for the command injection vulnerability.
  • Ensure that all inputs to the checkPermission function are validated and sanitized before use, preventing malformed arguments from reaching the operating system.
  • If an upgrade cannot be performed immediately, restrict the execution environment or quarantine the affected component to limit the potential for command injection.

Generated by OpenCVE AI on November 5, 2026 at 03:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
Title Purocean Yank Note Terminal index.ts checkPermission os command injection
First Time appeared Purocean
Purocean yank Note
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*
Vendors & Products Purocean
Purocean yank Note
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Purocean Yank Note
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-05T01:45:55.499Z

Reserved: 2026-11-04T18:38:22.936Z

Link: CVE-2026-122157

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-05T02:16:58.240

Modified: 2026-11-05T02:16:58.433

Link: CVE-2026-122157

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T03:45:18Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')