Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by codexu
CVE-2026-17497 (GCVE-0-2026-17497)
Vulnerability from nvd – Published: 2026-07-26 14:38 – Updated: 2026-07-26 14:38
VLAI
EPSS
VEX
Title
NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
Summary
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.
Severity
8.3 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/codexu/note-gen/commit/00064a4… | patch |
| https://github.com/codexu/note-gen/releases/tag/n… | vendor-advisory |
| https://github.com/codexu/note-gen | product |
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/codexu/note-gen",
"defaultStatus": "unaffected",
"packageName": "note-gen",
"product": "NoteGen",
"programFiles": [
"src-tauri/capabilities/default.json",
"src-tauri/capabilities/desktop.json"
],
"repo": "git://github.com/codexu/note-gen",
"vendor": "codexu",
"versions": [
{
"lessThan": "0.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.\u003c/p\u003e"
}
],
"value": "Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\u003c/p\u003e"
}
],
"value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u0026lt;command\u0026gt;\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.\u003c/p\u003e"
}
],
"value": "A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u003ccommand\u003e\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
},
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1249",
"description": "CWE-1249 Application-Level admin tool with inconsistent view of underlying operating system",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T14:38:08.960Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Fix: remove unrestricted shell execute for bash/python; harden skill script execution",
"tags": [
"patch"
],
"url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f"
},
{
"name": "NoteGen v0.32.0 release",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0"
},
{
"name": "NoteGen repository",
"tags": [
"product"
],
"url": "https://github.com/codexu/note-gen"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.\u003c/p\u003e"
}
],
"value": "Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Vulnerability discovered and PoC verified"
},
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Fix released in NoteGen v0.32.0 (shell capability lockdown)"
}
],
"title": "NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-17497",
"datePublished": "2026-07-26T14:38:08.960Z",
"dateReserved": "2026-07-26T14:37:51.448Z",
"dateUpdated": "2026-07-26T14:38:08.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17496 (GCVE-0-2026-17496)
Vulnerability from nvd – Published: 2026-07-26 14:33 – Updated: 2026-07-26 14:33
VLAI
EPSS
VEX
Title
NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
Summary
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).
Severity
8.1 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/codexu/note-gen/commit/ae3ba94… | patch |
| https://github.com/codexu/note-gen/releases/tag/n… | vendor-advisory |
| https://github.com/codexu/note-gen | product |
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/codexu/note-gen",
"defaultStatus": "unaffected",
"packageName": "note-gen",
"product": "NoteGen",
"programFiles": [
"src/app/core/main/chat/chat-preview.tsx"
],
"repo": "git://github.com/codexu/note-gen",
"vendor": "codexu",
"versions": [
{
"lessThan": "0.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires user interaction to install or otherwise load attacker-influenced skill/content and to view a chat response that includes the malicious HTML. No non-default configuration is required; CSP is null in affected builds.\u003c/p\u003e"
}
],
"value": "Affects the NoteGen desktop application on a default installation. Exploitation requires user interaction to install or otherwise load attacker-influenced skill/content and to view a chat response that includes the malicious HTML. No non-default configuration is required; CSP is null in affected builds."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).\u003c/p\u003e"
}
],
"value": "NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting)."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T14:33:02.602Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Fix: chat rendering moved to Streamdown",
"tags": [
"patch"
],
"url": "https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298"
},
{
"name": "NoteGen v0.32.0 release",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0"
},
{
"name": "NoteGen repository",
"tags": [
"product"
],
"url": "https://github.com/codexu/note-gen"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix replaces unsanitized markdown-it HTML injection in chat preview with Streamdown-based rendering that hardens/sanitizes untrusted HTML in model output.\u003c/p\u003e"
}
],
"value": "Upgrade to NoteGen 0.32.0 or later. The fix replaces unsanitized markdown-it HTML injection in chat preview with Streamdown-based rendering that hardens/sanitizes untrusted HTML in model output."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Vulnerability discovered and PoC verified"
},
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Fix released in NoteGen v0.32.0 (Streamdown chat rendering)"
}
],
"title": "NoteGen chat preview XSS via unsanitized AI/skill HTML rendering",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-17496",
"datePublished": "2026-07-26T14:33:02.602Z",
"dateReserved": "2026-07-26T14:28:45.607Z",
"dateUpdated": "2026-07-26T14:33:02.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17497 (GCVE-0-2026-17497)
Vulnerability from cvelistv5 – Published: 2026-07-26 14:38 – Updated: 2026-07-26 14:38
VLAI
EPSS
VEX
Title
NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
Summary
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.
Severity
8.3 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/codexu/note-gen/commit/00064a4… | patch |
| https://github.com/codexu/note-gen/releases/tag/n… | vendor-advisory |
| https://github.com/codexu/note-gen | product |
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/codexu/note-gen",
"defaultStatus": "unaffected",
"packageName": "note-gen",
"product": "NoteGen",
"programFiles": [
"src-tauri/capabilities/default.json",
"src-tauri/capabilities/desktop.json"
],
"repo": "git://github.com/codexu/note-gen",
"vendor": "codexu",
"versions": [
{
"lessThan": "0.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.\u003c/p\u003e"
}
],
"value": "Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\u003c/p\u003e"
}
],
"value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u0026lt;command\u0026gt;\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.\u003c/p\u003e"
}
],
"value": "A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u003ccommand\u003e\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
},
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1249",
"description": "CWE-1249 Application-Level admin tool with inconsistent view of underlying operating system",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T14:38:08.960Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Fix: remove unrestricted shell execute for bash/python; harden skill script execution",
"tags": [
"patch"
],
"url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f"
},
{
"name": "NoteGen v0.32.0 release",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0"
},
{
"name": "NoteGen repository",
"tags": [
"product"
],
"url": "https://github.com/codexu/note-gen"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.\u003c/p\u003e"
}
],
"value": "Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Vulnerability discovered and PoC verified"
},
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Fix released in NoteGen v0.32.0 (shell capability lockdown)"
}
],
"title": "NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-17497",
"datePublished": "2026-07-26T14:38:08.960Z",
"dateReserved": "2026-07-26T14:37:51.448Z",
"dateUpdated": "2026-07-26T14:38:08.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17496 (GCVE-0-2026-17496)
Vulnerability from cvelistv5 – Published: 2026-07-26 14:33 – Updated: 2026-07-26 14:33
VLAI
EPSS
VEX
Title
NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
Summary
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).
Severity
8.1 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/codexu/note-gen/commit/ae3ba94… | patch |
| https://github.com/codexu/note-gen/releases/tag/n… | vendor-advisory |
| https://github.com/codexu/note-gen | product |
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/codexu/note-gen",
"defaultStatus": "unaffected",
"packageName": "note-gen",
"product": "NoteGen",
"programFiles": [
"src/app/core/main/chat/chat-preview.tsx"
],
"repo": "git://github.com/codexu/note-gen",
"vendor": "codexu",
"versions": [
{
"lessThan": "0.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires user interaction to install or otherwise load attacker-influenced skill/content and to view a chat response that includes the malicious HTML. No non-default configuration is required; CSP is null in affected builds.\u003c/p\u003e"
}
],
"value": "Affects the NoteGen desktop application on a default installation. Exploitation requires user interaction to install or otherwise load attacker-influenced skill/content and to view a chat response that includes the malicious HTML. No non-default configuration is required; CSP is null in affected builds."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).\u003c/p\u003e"
}
],
"value": "NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting)."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T14:33:02.602Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Fix: chat rendering moved to Streamdown",
"tags": [
"patch"
],
"url": "https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298"
},
{
"name": "NoteGen v0.32.0 release",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0"
},
{
"name": "NoteGen repository",
"tags": [
"product"
],
"url": "https://github.com/codexu/note-gen"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix replaces unsanitized markdown-it HTML injection in chat preview with Streamdown-based rendering that hardens/sanitizes untrusted HTML in model output.\u003c/p\u003e"
}
],
"value": "Upgrade to NoteGen 0.32.0 or later. The fix replaces unsanitized markdown-it HTML injection in chat preview with Streamdown-based rendering that hardens/sanitizes untrusted HTML in model output."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Vulnerability discovered and PoC verified"
},
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Fix released in NoteGen v0.32.0 (Streamdown chat rendering)"
}
],
"title": "NoteGen chat preview XSS via unsanitized AI/skill HTML rendering",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-17496",
"datePublished": "2026-07-26T14:33:02.602Z",
"dateReserved": "2026-07-26T14:28:45.607Z",
"dateUpdated": "2026-07-26T14:33:02.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}