Skip to content
OpenAdvisories

Product · codexu

NoteGen

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.3
    CVE-2026-17497

    NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

    NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|exec…

    codexu NoteGen
  • High 8.1
    CVE-2026-17496

    NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

    NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that re…

    codexu NoteGen