CVE-2026-17496

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/codexu/note-gen	Product
https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298	Patch
https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0	Product Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) NoteGen antes de la versión 0.32.0 renderiza las respuestas del chat de IA con markdown-it configurado con html:true e inyecta el resultado en el DOM a través de dangerouslySetInnerHTML en chat-preview, sin saneamiento de HTML y con CSP establecido en null. Contenido controlado por el atacante que llega al prompt del modelo (por ejemplo, un REFERENCE.md de habilidad malicioso que instruye al modelo a emitir HTML) puede hacer que la respuesta del modelo incluya marcado ejecutable como un gestor img onerror. Cuando el usuario ve la respuesta del chat, ese marcado se ejecuta como JavaScript en la webview privilegiada de Tauri, permitiendo la ejecución arbitraria de scripts en el contexto de la aplicación (cross-site scripting).

Information

Published : 2026-07-26 15:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-17496

Mitre link : CVE-2026-17496

CVE.ORG link : CVE-2026-17496

JSON object : View

Products Affected

notegen

notegen

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-17496", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17496", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T14:44:36.321556Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"repo": "git://github.com/codexu/note-gen", "vendor": "codexu", "product": "NoteGen", "versions": [{"status": "affected", "version": "0", "lessThan": "0.32.0", "versionType": "semver"}], "packageName": "note-gen", "programFiles": ["src/app/core/main/chat/chat-preview.tsx"], "collectionURL": "https://github.com/codexu/note-gen", "defaultStatus": "unaffected"}]}], "published": "2026-07-26T15:16:27.710", "references": [{"url": "https://github.com/codexu/note-gen", "tags": ["Product"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298", "tags": ["Patch"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0", "tags": ["Product", "Release Notes"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting)."}, {"lang": "es", "value": "NoteGen antes de la versi\u00f3n 0.32.0 renderiza las respuestas del chat de IA con markdown-it configurado con html:true e inyecta el resultado en el DOM a trav\u00e9s de dangerouslySetInnerHTML en chat-preview, sin saneamiento de HTML y con CSP establecido en null. Contenido controlado por el atacante que llega al prompt del modelo (por ejemplo, un REFERENCE.md de habilidad malicioso que instruye al modelo a emitir HTML) puede hacer que la respuesta del modelo incluya marcado ejecutable como un gestor img onerror. Cuando el usuario ve la respuesta del chat, ese marcado se ejecuta como JavaScript en la webview privilegiada de Tauri, permitiendo la ejecuci\u00f3n arbitraria de scripts en el contexto de la aplicaci\u00f3n (cross-site scripting)."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F83DD43-1270-4565-A7C2-571006205DDC", "versionEndExcluding": "0.32.0"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}