Search
Find a vulnerability
Search criteria
6 vulnerabilities by Purocean
CVE-2026-122157 (GCVE-0-2026-122157)
Vulnerability from nvd – Published: 2026-11-05 01:45 – Updated: 2026-11-05 01:45 X_Open Source
VLAI
EPSS
VEX
Title
Purocean Yank Note Terminal index.ts checkPermission os command injection
Summary
A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431157 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431157/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122157 | third-party-advisory |
| https://vuldb.com/submit/1028030 | third-party-advisory |
| https://github.com/purocean/yn/issues/531 | exploitissue-tracking |
| https://github.com/purocean/yn/pull/535 | issue-trackingpatch |
| https://github.com/purocean/yn/commit/59f85d48f17… | patch |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"
],
"modules": [
"Terminal Handler"
],
"product": "Yank Note",
"vendor": "Purocean",
"versions": [
{
"status": "affected",
"version": "3.93.0"
},
{
"status": "unaffected",
"version": "3.93.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CopperKoi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T01:45:55.499Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431157 | Purocean Yank Note Terminal index.ts checkPermission os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431157"
},
{
"name": "VDB-431157 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431157/cti"
},
{
"name": "CVE-2026-122157 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122157"
},
{
"name": "Submit #1028030 | Purocean Yank Note 3.93.0 OS Command Injection / Missing Authentication for Critical Funct",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028030"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/531"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/purocean/yn/pull/535"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T19:43:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "Purocean Yank Note Terminal index.ts checkPermission os command injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122157",
"datePublished": "2026-11-05T01:45:55.499Z",
"dateReserved": "2026-11-04T18:38:22.936Z",
"dateUpdated": "2026-11-05T01:45:55.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122154 (GCVE-0-2026-122154)
Vulnerability from nvd – Published: 2026-11-05 01:30 – Updated: 2026-11-05 01:30 X_Open Source
VLAI
EPSS
VEX
Title
purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
Summary
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431155 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431155/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122154 | third-party-advisory |
| https://vuldb.com/submit/1028031 | third-party-advisory |
| https://github.com/purocean/yn/issues/532 | exploitissue-tracking |
| https://github.com/purocean/yn/pull/535 | issue-trackingpatch |
| https://github.com/purocean/yn/commit/59f85d48f17… | patch |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"
],
"modules": [
"Settings Endpoint"
],
"product": "Yank Note",
"vendor": "purocean",
"versions": [
{
"status": "affected",
"version": "3.93.0"
},
{
"status": "unaffected",
"version": "3.93.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CopperKoi (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T01:30:31.582Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431155 | purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431155"
},
{
"name": "VDB-431155 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431155/cti"
},
{
"name": "CVE-2026-122154 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122154"
},
{
"name": "Submit #1028031 | Purocean Yank Note 3.93.0 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028031"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/532"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/purocean/yn/pull/535"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T19:40:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122154",
"datePublished": "2026-11-05T01:30:31.582Z",
"dateReserved": "2026-11-04T18:35:15.823Z",
"dateUpdated": "2026-11-05T01:30:31.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111915 (GCVE-0-2026-111915)
Vulnerability from nvd – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:35
VLAI
EPSS
VEX
Title
Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Summary
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/purocean/yn/issues/543 | issue-tracking |
| https://github.com/purocean/yn/commit/d3b0ad27f7f… | patch |
| https://github.com/purocean/yn/blob/v3.93.0/src/m… | technical-description |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | release-notes |
| https://www.vulncheck.com/advisories/yank-note-be… | third-party-advisory |
Impacted products
Date Public
2026-10-17 00:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111915",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:52.746733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:35:17.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/purocean/yn",
"product": "Yank Note",
"repo": "https://github.com/purocean/yn",
"vendor": "purocean",
"versions": [
{
"lessThan": "3.93.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yank-note:yank_note:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.93.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-17T00:44:29.000Z",
"descriptions": [
{
"lang": "en",
"value": "Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated \u0027../\u0027 segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:08.190Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/543"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/d3b0ad27f7f6388b878eefd828557ae2d2a8789b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/purocean/yn/blob/v3.93.0/src/main/server/index.ts"
},
{
"name": "Yank Note v3.93.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
},
{
"name": "VulnCheck Advisory: Yank Note before 3.93.1 Path Traversal via /api/help Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yank-note-before-3.93.1-path-traversal-via-api-help-endpoint"
}
],
"title": "Yank Note before 3.93.1 Path Traversal via /api/help Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111915",
"datePublished": "2026-10-19T13:55:08.190Z",
"dateReserved": "2026-10-17T12:18:55.462Z",
"dateUpdated": "2026-10-19T16:35:17.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122157 (GCVE-0-2026-122157)
Vulnerability from cvelistv5 – Published: 2026-11-05 01:45 – Updated: 2026-11-05 01:45 X_Open Source
VLAI
EPSS
VEX
Title
Purocean Yank Note Terminal index.ts checkPermission os command injection
Summary
A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431157 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431157/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122157 | third-party-advisory |
| https://vuldb.com/submit/1028030 | third-party-advisory |
| https://github.com/purocean/yn/issues/531 | exploitissue-tracking |
| https://github.com/purocean/yn/pull/535 | issue-trackingpatch |
| https://github.com/purocean/yn/commit/59f85d48f17… | patch |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"
],
"modules": [
"Terminal Handler"
],
"product": "Yank Note",
"vendor": "Purocean",
"versions": [
{
"status": "affected",
"version": "3.93.0"
},
{
"status": "unaffected",
"version": "3.93.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CopperKoi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T01:45:55.499Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431157 | Purocean Yank Note Terminal index.ts checkPermission os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431157"
},
{
"name": "VDB-431157 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431157/cti"
},
{
"name": "CVE-2026-122157 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122157"
},
{
"name": "Submit #1028030 | Purocean Yank Note 3.93.0 OS Command Injection / Missing Authentication for Critical Funct",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028030"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/531"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/purocean/yn/pull/535"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T19:43:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "Purocean Yank Note Terminal index.ts checkPermission os command injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122157",
"datePublished": "2026-11-05T01:45:55.499Z",
"dateReserved": "2026-11-04T18:38:22.936Z",
"dateUpdated": "2026-11-05T01:45:55.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122154 (GCVE-0-2026-122154)
Vulnerability from cvelistv5 – Published: 2026-11-05 01:30 – Updated: 2026-11-05 01:30 X_Open Source
VLAI
EPSS
VEX
Title
purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
Summary
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431155 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431155/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122154 | third-party-advisory |
| https://vuldb.com/submit/1028031 | third-party-advisory |
| https://github.com/purocean/yn/issues/532 | exploitissue-tracking |
| https://github.com/purocean/yn/pull/535 | issue-trackingpatch |
| https://github.com/purocean/yn/commit/59f85d48f17… | patch |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"
],
"modules": [
"Settings Endpoint"
],
"product": "Yank Note",
"vendor": "purocean",
"versions": [
{
"status": "affected",
"version": "3.93.0"
},
{
"status": "unaffected",
"version": "3.93.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CopperKoi (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T01:30:31.582Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431155 | purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431155"
},
{
"name": "VDB-431155 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431155/cti"
},
{
"name": "CVE-2026-122154 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122154"
},
{
"name": "Submit #1028031 | Purocean Yank Note 3.93.0 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028031"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/532"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/purocean/yn/pull/535"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T19:40:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122154",
"datePublished": "2026-11-05T01:30:31.582Z",
"dateReserved": "2026-11-04T18:35:15.823Z",
"dateUpdated": "2026-11-05T01:30:31.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111915 (GCVE-0-2026-111915)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:35
VLAI
EPSS
VEX
Title
Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Summary
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/purocean/yn/issues/543 | issue-tracking |
| https://github.com/purocean/yn/commit/d3b0ad27f7f… | patch |
| https://github.com/purocean/yn/blob/v3.93.0/src/m… | technical-description |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | release-notes |
| https://www.vulncheck.com/advisories/yank-note-be… | third-party-advisory |
Impacted products
Date Public
2026-10-17 00:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111915",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:52.746733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:35:17.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/purocean/yn",
"product": "Yank Note",
"repo": "https://github.com/purocean/yn",
"vendor": "purocean",
"versions": [
{
"lessThan": "3.93.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yank-note:yank_note:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.93.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-17T00:44:29.000Z",
"descriptions": [
{
"lang": "en",
"value": "Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated \u0027../\u0027 segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:08.190Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/purocean/yn/issues/543"
},
{
"tags": [
"patch"
],
"url": "https://github.com/purocean/yn/commit/d3b0ad27f7f6388b878eefd828557ae2d2a8789b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/purocean/yn/blob/v3.93.0/src/main/server/index.ts"
},
{
"name": "Yank Note v3.93.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/purocean/yn/releases/tag/v3.93.1"
},
{
"name": "VulnCheck Advisory: Yank Note before 3.93.1 Path Traversal via /api/help Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yank-note-before-3.93.1-path-traversal-via-api-help-endpoint"
}
],
"title": "Yank Note before 3.93.1 Path Traversal via /api/help Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111915",
"datePublished": "2026-10-19T13:55:08.190Z",
"dateReserved": "2026-10-17T12:18:55.462Z",
"dateUpdated": "2026-10-19T16:35:17.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}