Threats affecting pkg:github/VNote

VNote versions 3.11.0 through 4.11.x contain an OS command injection vulnerability in the Tasks feature. This occurs because magic variables like ${bufferName} and ${selectedText} are inserted into shell command strings without proper escaping. An attacker can craft a notebook with notes whose filenames or text include shell metacharacters, causing arbitrary commands to execute when a task referencing these variables is run. The vulnerability is fixed in version 4.12.0.