CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
Attackers can execute arbitrary JavaScript in the NoteGen desktop application by injecting malicious HTML into AI chat responses rendered without sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-17496?
CVE-2026-17496 is a high-severity cross-site scripting vulnerability in codexu NoteGen, published on 26 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).
Weakness: CWE-79
Which versions are affected by CVE-2026-17496?
It affects 1 product.
Products include Notegen Notegen.
How do I fix CVE-2026-17496?
No fix has been published for CVE-2026-17496 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-17496 being exploited?
There is no known exploitation of CVE-2026-17496 in the wild and no public exploit code.
Other vulnerabilities in codexu NoteGen
Sources
Also known as GHSA-gwhc-vprp-gfcg.