A stored XSS flaw exists in VNote’s handling of YAML frontmatter metadata. The application injects the raw frontmatter string into a pre element before sanitization, allowing an attacker to embed JavaScript that runs in the file:// viewer context. This script can read local note files and transmit their contents to a remote server, resulting in unauthorized disclosure of local data and potential remote exfiltration.

Vulnerable VNote versions are all releases prior to 4.3.0. The affected product is vnotex’s VNote note‑taking application.

The CVSS score of 8.2 indicates high severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to open a crafted Markdown file within VNote; once opened, the stored JavaScript executes in the local file context and can access both local files and remote URLs due to the QWebEngineSettings setting that permits local content to access remote resources.