Vulnerabilities

TI-2026-14355 CVE-2026-17497 · GHSA-r5ff-hq22-rhgv

NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

LOW 39

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00749 Published 2026-07-26 Fixed in 0.32.0 CWE-1249

TI-2026-14354 CVE-2026-17496 · GHSA-gwhc-vprp-gfcg

NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

LOW 38

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to nu…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00547 Published 2026-07-26 Fixed in 0.32.0 CWE-79

Vulnerabilities

Filters

NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

NoteGen chat preview XSS via unsanitized AI/skill HTML rendering