CVE-2026-86016— VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
Quick assessment
Affected
vnotex vnote
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VNote 是一款笔记平台。在 4.3.0 版本之前，VNote 在 src/data/extra/web/js/markdownit.js 中使用 语句，在 XSS 保护清理路径生效之前，将 YAML 前置元数据插入到一个 元素中。因此，打开攻击者提供的 Markdown 笔记文件可在 查看器上下文中执行存储的 JavaScript 代码。由于 设置允许本地内容访问远程 URL，该脚本可以在用户打开笔记文件后无需进一步交互，即可读取可访问的本地笔记文件内容，并将其传输到远程服务器。此问题已在 VNote 4.3.
Possible ATT&CK Techniques 3 AI
T1560.001 · Archive via Utility T1059.007 · JavaScript T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
Source: CVE Program / CVE List V5
Vulnerability Description
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86016
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86016 (1)
Vendor Advisories for CVE-2026-86016 (1)
Vendor Pages for CVE-2026-86016 (1)
-
🔗 Release v4.3.0 · vnotex/vnote · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: vnote
-
CVE-2026-86022
VNote: Argument injection to arbitrary command execution via -
CVE-2026-15505
vnotex vnote YAML Frontmatter markdownit.js cross site scrip -
CVE-2024-41662
VNote vulnerable to Markdown XSS, which leads to RCE -
CVE-2024-39904
Code Execution Vulnerability via Local File Path Traversal i -
CVE-2023-5701
vnotex vnote Markdown File cross site scripting
Same vendor: vnotex
-
CVE-2026-86022
VNote: Argument injection to arbitrary command execution via -
CVE-2026-15505
vnotex vnote YAML Frontmatter markdownit.js cross site scrip -
CVE-2024-41662
VNote vulnerable to Markdown XSS, which leads to RCE -
CVE-2024-39904
Code Execution Vulnerability via Local File Path Traversal i -
CVE-2023-5701
vnotex vnote Markdown File cross site scripting
Same weakness: CWE-79
-
CVE-2026-103369
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticat -
CVE-2026-101924
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Sc -
CVE-2026-100153
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Sc -
CVE-2026-97398
FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated -
CVE-2026-83592
Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored
V. Comments for CVE-2026-86016
No comments yet