Executive brief
NoteGen, a cross-platform AI note-taking application, is vulnerable to a security flaw where malicious content can execute unauthorized code. By providing the AI with specially crafted instructions or files, an attacker can force the application to run malicious scripts when a user views the AI's response. This could allow an attacker to steal sensitive notes, access local files, or take control of the application interface.
Technical details
NoteGen versions prior to 0.32.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the chat-preview component. The application used the markdown-it library with HTML rendering enabled (html:true) and injected the output into the DOM using dangerouslySetInnerHTML without proper sanitization. Furthermore, the Content Security Policy (CSP) was set to null. An attacker can exploit this by providing malicious input to the AI model (e.g., via a crafted REFERENCE.md file) that instructs the model to generate executable HTML markup, such as an image tag with an onerror handler. When rendered in the privileged Tauri webview, this results in arbitrary JavaScript execution. The issue was addressed in version 0.32.0 by migrating to Streamdown for rendering.
Affected products
- codexu NoteGen < 0.32.0
Timeline
- 2026-07-20: patched: Fix committed and version 0.32.0 released
- 2026-07-26: advisory: CVE-2026-17496 published