VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(…), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.
Bu kayıt NIST NVD kaynağından aktarılmıştır. Etkilenen sürümler, güncel değerlendirme ve üretici referansları için kaynak kaydı inceleyin.