CVE-2020-26157: 
Homebrew vulnerability analysis and mitigation

Leanote Desktop through version 2.6.2 contains a Cross-Site Scripting (XSS) vulnerability that can lead to remote code execution. The vulnerability exists because a note's title is mishandled during syncing, and due to Node integration, this can result in arbitrary code execution (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.6 (CRITICAL) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The combination of XSS vulnerability with Node integration creates a particularly severe security risk, as it allows the execution of arbitrary code on the affected system (NVD).

The vulnerability can result in complete compromise of the affected system's confidentiality, integrity, and availability. Due to the Node integration feature, successful exploitation allows attackers to execute arbitrary code on the target system, potentially leading to full system compromise (NVD).

The vulnerability requires user interaction but has a low attack complexity and requires no privileges for exploitation. The attack vector is network-accessible, making it possible to exploit remotely (NVD).

Users should upgrade to a version newer than 2.6.2 if available. The vulnerability affects all versions through 2.6.2 of Leanote Desktop (NVD).