Executive brief
NoteGen, an AI-powered note-taking application, contains a security flaw in how it handles system commands. The application incorrectly allows its internal web components to execute powerful scripts (like Python and Bash) with full system permissions. If an attacker can trick a user into viewing malicious content within the app, such as through a chat message, they could remotely take control of the user's computer and access their files.
Technical details
NoteGen versions prior to 0.32.0 grant the Tauri 'shell:allow-execute' capability to bash, python, and python3 with arbitrary arguments in the default desktop configuration. This misconfiguration allows JavaScript running within the application's webview to invoke the 'plugin:shell|execute' command. An attacker who achieves script execution in the webview (e.g., via a chat-based XSS) can leverage this to execute arbitrary operating system commands with the privileges of the NoteGen process. The issue was addressed in version 0.32.0 by improving skill script security and isolating the runtime environment.
Affected products
- codexu NoteGen before 0.32.0
Timeline
- 2026-07-19: patched: Fix committed to repository
- 2026-07-20: advisory: Release v0.32.0 published
- 2026-07-26: disclosed: CVE published to NVD