CVE-2026-17497 (GCVE-0-2026-17497)
Vulnerability from cvelistv5 – Published: 2026-07-26 14:38 – Updated: 2026-07-27 14:49
VLAI
EPSS
VEX
Title
NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
Summary
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/codexu/note-gen/commit/00064a4… | patch |
| https://github.com/codexu/note-gen/releases/tag/n… | vendor-advisory |
| https://github.com/codexu/note-gen | product |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T14:48:49.754931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T14:49:03.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/codexu/note-gen",
"defaultStatus": "unaffected",
"packageName": "note-gen",
"product": "NoteGen",
"programFiles": [
"src-tauri/capabilities/default.json",
"src-tauri/capabilities/desktop.json"
],
"repo": "git://github.com/codexu/note-gen",
"vendor": "codexu",
"versions": [
{
"lessThan": "0.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.\u003c/p\u003e"
}
],
"value": "Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\u003c/p\u003e"
}
],
"value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u0026lt;command\u0026gt;\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.\u003c/p\u003e"
}
],
"value": "A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u003ccommand\u003e\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
},
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1249",
"description": "CWE-1249 Application-Level admin tool with inconsistent view of underlying operating system",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T14:38:08.960Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Fix: remove unrestricted shell execute for bash/python; harden skill script execution",
"tags": [
"patch"
],
"url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f"
},
{
"name": "NoteGen v0.32.0 release",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0"
},
{
"name": "NoteGen repository",
"tags": [
"product"
],
"url": "https://github.com/codexu/note-gen"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.\u003c/p\u003e"
}
],
"value": "Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Vulnerability discovered and PoC verified"
},
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Fix released in NoteGen v0.32.0 (shell capability lockdown)"
}
],
"title": "NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-17497",
"datePublished": "2026-07-26T14:38:08.960Z",
"dateReserved": "2026-07-26T14:37:51.448Z",
"dateUpdated": "2026-07-27T14:49:03.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-17497",
"date": "2026-07-27",
"epss": "0.00455",
"percentile": "0.37086"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-17497\",\"sourceIdentifier\":\"reefs@jfrog.com\",\"published\":\"2026-07-26T15:16:27.873\",\"lastModified\":\"2026-07-27T20:37:16.927\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\"}],\"affected\":[{\"source\":\"reefs@jfrog.com\",\"affectedData\":[{\"vendor\":\"codexu\",\"product\":\"NoteGen\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/codexu/note-gen\",\"packageName\":\"note-gen\",\"programFiles\":[\"src-tauri/capabilities/default.json\",\"src-tauri/capabilities/desktop.json\"],\"repo\":\"git://github.com/codexu/note-gen\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.32.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"reefs@jfrog.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-27T14:48:49.754931Z\",\"id\":\"CVE-2026-17497\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"reefs@jfrog.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"},{\"lang\":\"en\",\"value\":\"CWE-276\"},{\"lang\":\"en\",\"value\":\"CWE-1249\"}]}],\"references\":[{\"url\":\"https://github.com/codexu/note-gen\",\"source\":\"reefs@jfrog.com\"},{\"url\":\"https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f\",\"source\":\"reefs@jfrog.com\"},{\"url\":\"https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0\",\"source\":\"reefs@jfrog.com\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Yuval Moravchick\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"JFrog Security Research\"}], \"impacts\": [{\"capecId\": \"CAPEC-242\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-242 Code Injection\"}]}, {\"capecId\": \"CAPEC-549\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-549 Local Execution of Code\"}]}, {\"capecId\": \"CAPEC-17\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-17 Using Malicious Files\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"git://github.com/codexu/note-gen\", \"vendor\": \"codexu\", \"product\": \"NoteGen\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.32.0\", \"versionType\": \"semver\"}], \"packageName\": \"note-gen\", \"programFiles\": [\"src-tauri/capabilities/default.json\", \"src-tauri/capabilities/desktop.json\"], \"collectionURL\": \"https://github.com/codexu/note-gen\", \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u003ccommand\u003e\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke(\u0027plugin:shell|execute\u0027, { program: \u0027bash\u0027, args: [\u0027-c\u0027, \u0027\u0026lt;command\u0026gt;\u0027], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.\u003c/p\u003e\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-08T00:00:00.000Z\", \"value\": \"Vulnerability discovered and PoC verified\"}, {\"lang\": \"en\", \"time\": \"2026-07-20T00:00:00.000Z\", \"value\": \"Fix released in NoteGen v0.32.0 (shell capability lockdown)\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f\", \"name\": \"Fix: remove unrestricted shell execute for bash/python; harden skill script execution\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0\", \"name\": \"NoteGen v0.32.0 release\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/codexu/note-gen\", \"name\": \"NoteGen repository\", \"tags\": [\"product\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eNoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user\u0027s machine.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1249\", \"description\": \"CWE-1249 Application-Level admin tool with inconsistent view of underlying operating system\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276 Incorrect default permissions\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAffects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"shortName\": \"JFROG\", \"dateUpdated\": \"2026-07-26T14:38:08.960Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-17497\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-27T14:48:49.754931Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-07-27T14:48:59.520Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-17497\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-26T14:38:08.960Z\", \"dateReserved\": \"2026-07-26T14:37:51.448Z\", \"assignerOrgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"datePublished\": \"2026-07-26T14:38:08.960Z\", \"assignerShortName\": \"JFROG\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…