CVE-2026-122157
Description
A flaw was found in Yank Note. The terminal handler fails to properly sanitize input during permission checks, resulting in an operating system command injection vulnerability. A remote attacker could exploit this flaw by submitting specially crafted input, allowing arbitrary command execution on the host system.
Statement
This vulnerability is rated as Important because remote unauthenticated attackers could trigger command injection to execute arbitrary commands, posing a substantial risk to host integrity and confidentiality. Yank Note is not packaged, supported, or distributed within Red Hat Enterprise Linux or any other Red Hat product line. As a result, default Red Hat systems remain unaffected unless this third-party software is independently installed and operated.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
