CVE-2026-15505

A vulnerability exists within the vnotex vnote component (up to version 3.20.1) that allows an attacker to manipulate the p_metaData argument supplied to the YAML Frontmatter parser in markdownit.js. By injecting crafted data into this argument, an arbitrary script can be executed in the context of any user who renders the affected markdown file. This type of flaw is classified as a Cross‑Site Scripting (XSS) weakness (CWE‑79) with the potential for code execution (CWE‑94) in the client‑side environment. The attack surface malicious actor can trigger this exploit without local access to the system.

Affected systems are those running the vnotex vnote application, specifically versions up to and including 3.20.1. The weakness resides in an unknown function within the file /src/data/extra/web/js/markdownit.js and is triggered by the YAML Frontmatter feature of the editor.

The vulnerability is rated with a CVSS score of 5.1, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low probability of exploitation in the wild at this time. The flaw is not listed in the CISA vector means that any user who opens a maliciously crafted markdown file can be exposed to script execution, potentially compromising their session or personal data. The lack of an official response from the vendor adds to the risk profile, as no vendor‑issued fix is currently available in the public domain.