CVE-2026-17496 in NoteGen
Summary
by MITRE • 07/26/2026
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability represents a critical cross-site scripting flaw in NoteGen versions prior to 0320 where the application fails to properly sanitize user-controlled content before rendering AI chat responses. The core issue stems from the markdown-it library configuration with html:true parameter, which allows raw HTML processing, combined with direct DOM injection through dangerouslySetInnerHTML without any sanitization measures. The vulnerability operates at the intersection of insecure input handling and privilege escalation, as the application's Content Security Policy is set to null, eliminating any protective barriers against malicious script execution.
The technical exploitation pathway begins with attacker-controlled content reaching the model prompt through a malicious skill reference file such as REFERENCE.md that contains instructions for the AI model to generate HTML markup. When the model processes this prompt, it can produce executable markup including img onerror handlers or other JavaScript payloads embedded within the response. Upon user interaction with the chat preview, the unfiltered HTML content executes within the privileged Tauri webview context, enabling arbitrary script execution that operates at the application's security level rather than in a restricted sandboxed environment. This represents a classic server-side template injection vulnerability amplified by client-side DOM manipulation without proper sanitization.
The operational impact of this vulnerability extends beyond simple XSS attacks as it provides attackers with complete control over the NoteGen application environment through the Tauri webview context. An attacker could potentially exfiltrate user data, modify application settings, execute malicious commands, or establish persistent access through the compromised privileged execution context. The vulnerability's severity is compounded by the fact that it requires minimal user interaction beyond viewing a chat response, making it particularly dangerous for environments where users may encounter untrusted AI-generated content from third-party skills or plugins.
Security mitigations must address multiple layers of the vulnerability chain beginning with proper HTML sanitization of all user-controlled content before DOM injection. The application should implement a robust sanitization library such as DOMPurify to filter malicious markup from AI responses before rendering them in the webview. Additionally, the Content Security Policy should be configured with strict rules that prevent inline script execution and restrict resource loading from untrusted sources. The markdown-it configuration should disable html:true or implement proper validation when HTML processing is required. According to CWE standards, this vulnerability aligns with CWE-79 (Cross-site Scripting) and CWE-1021 (Improper Restriction of Rendered UI Layers or Views) while mapping to ATT&CK techniques including T1059.007 (Command and Scripting Interpreter: JavaScript) and T1566.002 (Phishing: Spearphishing Attachments) for exploitation purposes.