note-mark

10 results · Feed

• High 8.6
  CVE-2026-50553

  Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

  Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.Match…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  Sep 4, 2026
• Medium 5.3
  CVE-2026-50554

  Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

  Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() …

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  Sep 3, 2026
• High 8.6
  CVE-2026-44522

  Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

  Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  May 14, 2026
• Critical 10.0
  CVE-2026-44523

  Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

  Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte.…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  May 14, 2026
• Medium 5.3
  CVE-2026-41572

  Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

  Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. U…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  May 4, 2026
• Critical 9.4
  CVE-2026-41571

  Note Mark: OIDC-registered users authenticated by submitting password "null"

  Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty passw…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  May 4, 2026
• Medium 5.9
  CVE-2026-40265

  Note Mark has Broken Access Control on Asset Download

  Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book vis…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  Apr 16, 2026
• Low 3.7
  CVE-2026-40263

  Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

  Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  Apr 16, 2026
• High 8.7
  CVE-2026-40262

  Note Mark has Stored XSS via Unrestricted Asset Upload

  Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XH…

  enchant97 note-mark github.com/enchant97/note-mark/backend Go
  Apr 16, 2026
• High 8.7
  CVE-2024-41819

  Note Mark has a stored XSS in the note link href attribute

  Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerabili…

  enchant97 note-mark
  Jul 29, 2024