Publications

Research

Vulnerability research and coordinated disclosure. Advisories are published as vendors remediate.

• HighCVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)2026
  OS command injection (RCE) in QOwnNotes via a synced note filename

  A note filename is spliced into a bash -c string by the per-note Git-log feature, so a note delivered through a shared or synced notebook executes arbitrary commands when its history is viewed. Reported, fixed in 26.10.11.