Skip to content
OpenAdvisories

Package · Go

github.com/enchant97/note-mark/backend

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.6
    CVE-2026-50553

    Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

    Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.Match…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go
  • High 8.6
    CVE-2026-44522

    Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

    Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go
  • High 8.7
    CVE-2026-40262

    Note Mark has Stored XSS via Unrestricted Asset Upload

    Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XH…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go