The vulnerability allows an attacker to inject shell arguments through a note filename that contains a double quote. When the application passes the note path to QProcess via the external program configuration, the quoted path is unescaped by the OS and any trailing arguments are parsed as part of the command. If the configured external program accepts a command option—such as vim or gvim’s -c flag—the attacker can execute arbitrary commands with the privileges of the user running VNote. This flaw is a classic command injection (CWE‑78) and occurs in both the automatic document opening and the Open With workflow, potentially allowing attackers to read, modify, or delete arbitrary files, or to gain full control of the system. The flaw is present in all versions of VNote prior to 4.3.0. The affected product is the VNote desktop application for note‑taking, used on Linux and macOS. An attacker only needs to create or rename a note with a crafted filename; no network or elevated permissions are required beyond the local user. The vulnerability has a CVSS score of 7, indicating a high severity. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog, but the attack vector is local and does not require network connectivity. Because the exploit leverages a feature that is enabled by default (external program usage), an attacker who has a foothold on the system—such as from a compromised note or malicious script—can easily trigger the injection. The overall risk is significant for any user who allows external program integration without careful configuration.

VNote (vnotex:vnote), any installation of the VNote note‑taking application prior to version 4.3.0 on Linux or macOS, regardless of the specific operating system version.

The exploitation requires only a crafted note file containing a double quote, a feature available to any local user with write access to the note repository. The victim’s configured external program must accept a command argument; common programs such as vim provide this capability. The attacker can thus execute arbitrary commands while maintaining the privileges of the local user. The CVSS score of 7 signals a high impact, and although EPSS is not provided, the local nature of the attack means that the exploit can be performed offline. Since the flaw is not yet listed in KEV, there are no known widespread active exploitation campaigns, but the ease of trigger makes it a credible threat for targeted attacks.