Description
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vnotex | VNote | 3.11.0 – < 4.12.0 | 4.12.0 |
References
- https://github.com/vnotex/vnote/commit/0f5edd837d233a929d2a514a0e718d5d19c93918 patch
- VNote v4.12.0 Release Notes release-notes
- https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L8-L24 technical-description
- https://github.com/vnotex/vnote/blob/551dfd86b73ce6d93e5403296b069219cb668dc2/src/core/services/shellexecution.cpp#L50-L56 technical-description
- https://r3vpwnx.space/research/vnote-tasks-cmdinjection/ third-party-advisory technical-description
- VulnCheck Advisory: VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables third-party-advisory