Loading vulnerability…
Cross-site scripting in NoteGen AI chat response rendering
CVE-2026-17496 is a cross-site scripting vulnerability affecting NoteGen before version 0.32.0. The flaw arises because AI chat responses are rendered with markdown-it configured with HTML enabled and then inserted into the DOM through dangerouslySetInnerHTML without HTML sanitization. The issue is further exposed by the application's null Content Security Policy. If attacker-controlled content can influence the model prompt, the model can be induced to emit executable HTML markup. When a user views the rendered chat response, that markup executes as JavaScript inside the privileged Tauri webview, resulting in script execution within the application context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the privileged Tauri webview when a user views a maliciously influenced chat response. This can compromise confidentiality and integrity within the application context, including access to application data and the ability to perform actions available to the webview. The available information characterizes availability impact as none.
If you can’t patch tonight, do this now.
If immediate patching is not possible, avoid rendering untrusted AI-generated chat content, disable or tightly restrict features that allow attacker-controlled material to influence model prompts, and prevent HTML-capable rendering of model responses where possible. Additional defensive measures include disabling raw HTML support in markdown rendering, removing use of dangerouslySetInnerHTML for untrusted content, sanitizing rendered output, and enforcing a restrictive Content Security Policy.
Patch, then assume compromise.
Upgrade NoteGen to version 0.32.0 or later, which contains the fix for the unsafe rendering path. The vulnerable behavior should be corrected by preventing raw HTML execution in rendered model output and ensuring proper sanitization before insertion into the DOM.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.