Vulnerability · Published Jul 26, 2026 · Assigned by JFROG

CVE-2026-17496NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

High 8.1

In plain English

A high-severity cross-site scripting in NoteGen from codexu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

Affected products (as reported)

Vendor	Product	Versions
codexu	NoteGen	0 – before 0.32.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Fix: chat rendering moved to Streamdown patch
NoteGen v0.32.0 release vendor-advisory
NoteGen repository product