CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/codexu/note-gen	Product
https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f	Patch
https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0	Product Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-26 15:16

Updated : 2026-08-25 15:30

NVD link : CVE-2026-17497

Mitre link : CVE-2026-17497

CVE.ORG link : CVE-2026-17497

JSON object : View

Products Affected

notegen

notegen

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-276

Incorrect Default Permissions

CWE-1249

Application-Level Admin Tool with Inconsistent View of Underlying Operating System

{"id": "CVE-2026-17497", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17497", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T14:48:49.754931Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"repo": "git://github.com/codexu/note-gen", "vendor": "codexu", "product": "NoteGen", "versions": [{"status": "affected", "version": "0", "lessThan": "0.32.0", "versionType": "semver"}], "packageName": "note-gen", "programFiles": ["src-tauri/capabilities/default.json", "src-tauri/capabilities/desktop.json"], "collectionURL": "https://github.com/codexu/note-gen", "defaultStatus": "unaffected"}]}], "published": "2026-07-26T15:16:27.873", "references": [{"url": "https://github.com/codexu/note-gen", "tags": ["Product"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f", "tags": ["Patch"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0", "tags": ["Product", "Release Notes"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-1249"}]}], "descriptions": [{"lang": "en", "value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine."}], "lastModified": "2026-08-25T15:30:35.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F83DD43-1270-4565-A7C2-571006205DDC", "versionEndExcluding": "0.32.0"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}