CVE-2026-86016

VNote, a note-taking platform, contains a Stored XSS vulnerability in versions prior to 4.3.0 . The root cause is located in src/data/extra/web/js/markdownit.js, where the application assigns p_metaData to preNode.innerHTML before the protectFromXss sanitization path executes. This allows an atta...