CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/codexu/note-gen	Product
https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f	Patch
https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0	Product Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) NoteGen anterior a la versión 0.32.0 otorga al plugin de shell de Tauri la capacidad shell:allow-execute para bash, python y python3 con argumentos arbitrarios en las capacidades de escritorio predeterminadas. JavaScript ejecutándose en la webview de la aplicación puede, por lo tanto, invocar plugin:shell\|execute para ejecutar comandos del sistema operativo controlados por el atacante con los privilegios del proceso de NoteGen. En combinación con la ejecución de scripts en la webview (por ejemplo, a través de XSS en el chat), esto permite la ejecución remota de código completa en la máquina del usuario.

Information

Published : 2026-07-26 15:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-17497

Mitre link : CVE-2026-17497

CVE.ORG link : CVE-2026-17497

JSON object : View

Products Affected

notegen

notegen

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-276

Incorrect Default Permissions

CWE-1249

Application-Level Admin Tool with Inconsistent View of Underlying Operating System

{"id": "CVE-2026-17497", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17497", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T14:48:49.754931Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"repo": "git://github.com/codexu/note-gen", "vendor": "codexu", "product": "NoteGen", "versions": [{"status": "affected", "version": "0", "lessThan": "0.32.0", "versionType": "semver"}], "packageName": "note-gen", "programFiles": ["src-tauri/capabilities/default.json", "src-tauri/capabilities/desktop.json"], "collectionURL": "https://github.com/codexu/note-gen", "defaultStatus": "unaffected"}]}], "published": "2026-07-26T15:16:27.873", "references": [{"url": "https://github.com/codexu/note-gen", "tags": ["Product"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f", "tags": ["Patch"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0", "tags": ["Product", "Release Notes"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-1249"}]}], "descriptions": [{"lang": "en", "value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine."}, {"lang": "es", "value": "NoteGen anterior a la versi\u00f3n 0.32.0 otorga al plugin de shell de Tauri la capacidad shell:allow-execute para bash, python y python3 con argumentos arbitrarios en las capacidades de escritorio predeterminadas. JavaScript ejecut\u00e1ndose en la webview de la aplicaci\u00f3n puede, por lo tanto, invocar plugin:shell|execute para ejecutar comandos del sistema operativo controlados por el atacante con los privilegios del proceso de NoteGen. En combinaci\u00f3n con la ejecuci\u00f3n de scripts en la webview (por ejemplo, a trav\u00e9s de XSS en el chat), esto permite la ejecuci\u00f3n remota de c\u00f3digo completa en la m\u00e1quina del usuario."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F83DD43-1270-4565-A7C2-571006205DDC", "versionEndExcluding": "0.32.0"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}