汇总 leanote 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
历史漏洞主要涉及 跨站脚本与路径处理缺陷 等问题，部分漏洞可能导致 文件覆盖，并影响 生产负载与软件部署 相关场景。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2024-0849 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. | [email protected] | 5.0 | 0.23% | 2024-02-06 | 2026-06-17 |
| CVE-2021-4263 | A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability. | [email protected] | 3.5 | 0.52% | 2022-12-21 | 2026-06-17 |
| CVE-2021-43721 | Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();> | [email protected] | 6.1 | 0.99% | 2022-03-28 | 2026-06-17 |
| CVE-2020-26158 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.91% | 2020-09-30 | 2026-06-16 |
| CVE-2020-26157 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.91% | 2020-09-30 | 2026-06-16 |
| CVE-2019-1010003 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.64% | 2019-07-11 | 2026-06-16 |
| CVE-2018-18553 | Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. | [email protected] | 6.1 | 0.86% | 2018-10-21 | 2026-06-16 |
| CVE-2017-1000492 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration | [email protected] | 6.1 | 1.04% | 2018-01-02 | 2026-06-16 |
| CVE-2017-1000459 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes | [email protected] | 6.1 | 0.84% | 2018-01-02 | 2026-06-16 |