CVE-2026-17496: NoteGen XSS Vulnerability

CVE-2026-17496 Overview

CVE-2026-17496 is a cross-site scripting (XSS) vulnerability [CWE-79] in NoteGen, an AI-powered note-taking application built on Tauri. Versions prior to 0.32.0 render AI chat responses using markdown-it configured with html:true and inject the output into the DOM through dangerouslySetInnerHTML in the chat-preview component. The application performs no HTML sanitization and sets the Content Security Policy (CSP) to null. Attacker-controlled content that reaches the model prompt, such as a malicious skill REFERENCE.md instructing the model to emit HTML, can produce responses containing executable markup. When the user views the response, the payload runs as JavaScript inside the privileged Tauri webview.

Critical Impact
Arbitrary script execution in the NoteGen Tauri application context, exposing local data and privileged desktop APIs available to the webview.

Affected Products

NoteGen (codexu/note-gen) versions prior to 0.32.0
Tauri desktop builds of NoteGen with default CSP configuration
Chat rendering component chat-preview using markdown-it with html:true

Discovery Timeline

2026-07-26 - CVE-2026-17496 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17496

Vulnerability Analysis

NoteGen renders assistant messages by piping model output through markdown-it with the html:true option, which passes raw HTML through the parser unchanged. The rendered HTML string is then written to the DOM using React's dangerouslySetInnerHTML in the chat-preview component. Because the application ships with CSP set to null, inline event handlers and inline scripts are permitted by the webview.

The attack path is indirect. Malicious content injected into the model context, for example through a poisoned skill file such as REFERENCE.md, can steer the model to emit HTML tags with event handlers. A payload like <img src=x onerror=...> becomes live markup when rendered. Execution occurs inside the Tauri webview, which is privileged and has access to invocable Tauri commands and local application state.

Root Cause

The root cause is a combination of three unsafe defaults: enabling raw HTML parsing in markdown-it, injecting untrusted output through dangerouslySetInnerHTML without sanitization (for example DOMPurify), and disabling CSP in the Tauri webview. Any single mitigation would have blocked the class of attack.

Attack Vector

Exploitation requires user interaction: the victim must load a chat that includes attacker-influenced content. The vector is network-adjacent through any channel that can seed the model prompt, including shared skills, referenced documents, or web content retrieved by the agent.

text

// Patch excerpt from src-tauri/Cargo.toml (v0.32.0)
[target.'cfg(target_os = "macos")'.dependencies]
core-graphics = "0.23"
+objc2 = "0.6.1"
+objc2-app-kit = { version = "0.3.1", default-features = false, features = ["NSPrintInfo", "NSPrintOperation", "NSResponder", "NSWindow"] }
+objc2-foundation = { version = "0.3.1", default-features = false, features = ["NSDictionary", "NSObject", "NSString", "NSURL"] }
+objc2-web-kit = { version = "0.3.1", default-features = false, features = ["WKWebView", "objc2-app-kit"] }

Source: GitHub Commit ae3ba94. The fix replaces the direct markdown-it + dangerouslySetInnerHTML render pipeline with Streamdown-based rendering and adjusts native webview dependencies.

Detection Methods for CVE-2026-17496

Indicators of Compromise

Chat history entries containing raw HTML tags such as <img, <svg, <iframe>, or inline on* event handlers in assistant messages.
Skill or reference files (for example REFERENCE.md) that instruct the model to output HTML or JavaScript.
Unexpected outbound network connections initiated by the NoteGen process shortly after opening a chat.

Detection Strategies

Scan NoteGen application data directories for stored chat logs containing HTML event-handler patterns.
Inspect installed skills and referenced documents for prompt-injection strings targeting HTML emission.
Compare the installed NoteGen version against 0.32.0 and flag any earlier build.

Monitoring Recommendations

Monitor endpoint process telemetry for note-gen child processes spawning shells or scripting interpreters.
Alert on file writes by NoteGen to sensitive user directories that do not match normal note-taking behavior.
Log network egress from the NoteGen binary and review destinations against known-good AI API endpoints.

How to Mitigate CVE-2026-17496

Immediate Actions Required

Upgrade NoteGen to version 0.32.0 or later from the official release page.
Remove any untrusted skills, references, or imported documents added since the last known-good state.
Review recent chats for suspicious HTML content and clear affected history.

Patch Information

The fix is delivered in NoteGen 0.32.0 via commit ae3ba94, which reworks chat rendering using Streamdown and updates native webview dependencies. See the project repository for full release notes.

Workarounds

Do not install or enable skills from untrusted sources until the upgrade is applied.
Avoid pasting or referencing external Markdown documents from unknown origins into chat context.
Restrict the NoteGen application at the OS level using application allowlisting to limit blast radius.

bash

# Verify installed NoteGen version and upgrade path
note-gen --version
# If output is earlier than 0.32.0, download the patched release:
# https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0