CVE-2026-15505
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A cross-site scripting vulnerability has been found in vnotex vnote up to version 3.20.1 in the YAML Frontmatter processing function within markdownit.js. Manipulation of the p_metaData argument allows remote script execution in the victim's browser.
Risk Assessment
An attacker can remotely inject malicious scripts, leading to session theft, redirects, or display of fake content to application users.
Recommendation
Immediately upgrade vnotex vnote to a version newer than 3.20.1 if available, or apply temporary mitigations such as input filtering on YAML Frontmatter.
Original NVD description (English source)
A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component YAML Frontmatter. This manipulation of the argument p_metaData causes cross site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.