Read the docs
TI-2026-14354 Aliases CVE-2026-17496GHSA-gwhc-vprp-gfcg

NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed NoteGen (codexu): 0.32.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codexuNoteGenbefore 0.32.00.32.0Patch availableCNA
  • NoteGen Vendorcodexu Affected before 0.32.0 Fixed in 0.32.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:*before 0.32.0VulnerableNotegen
  • cpe:2.3:a:notegen:notegen:*:*:*:*:*:*:*:* Versions before 0.32.0 Vulnerable ·Notegen

Remediation

  • Fix · CNA NoteGen (codexu) Fixed in 0.32.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    codexu NoteGen — NoteGen v0.32.0 release

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-14355 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/pythonPriority LOW 39
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-17496
  2. 2026-10-03 Alias added: GHSA-gwhc-vprp-gfcg

References

Patch 1

Advisory 1

Other 1

  • TI-2026-76441 NoteGen Local File Disclosure via Chat Image Analysis CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences