Threats tagged 'ghsa-g98f-49h7-557q'

VNote versions 3.11.0 up to but not including 4.12.0 contain an OS command injection vulnerability in the Tasks feature. This occurs because magic variables like ${bufferName} and ${selectedText} are inserted into shell command strings without proper escaping. An attacker can craft a notebook with notes containing shell metacharacters, which when processed by a task, execute arbitrary commands on the victim's system.