Threats affecting pkg:github/purocean/yn

CVE-2026-122157 is an OS command injection vulnerability in Purocean Yank Note version 3.93.0. The flaw exists in the checkPermission function within the Terminal Handler component, allowing remote attackers to execute arbitrary OS commands. This vulnerability has a medium severity score of 5.3 and can be exploited without privileges or user interaction. A patch is available in version 3.93.1, which addresses this issue.

CVE-2026-122154 is an information disclosure vulnerability in purocean Yank Note version 3.93.0 affecting the Settings Endpoint component. The flaw exists in the config.getAll function of src/main/server/index.ts and can be exploited remotely without authentication. The vulnerability allows unauthorized disclosure of sensitive information. A public exploit is available. Upgrading to version 3.93.1 addresses the issue by removing the sensitive key from the response.