CVE-2026-17496 codexu CVE debrief

Who should care

Users of NoteGen before version 0.32.0 should update to the latest version to mitigate this vulnerability. Affected operators, platforms, and security teams should review and sanitize user-controlled input to AI chat responses, and implement Content Security Policy (CSP) to restrict script execution.

Technical summary

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

Defensive priority

High

Recommended defensive actions

• Update NoteGen to version 0.32.0 or later
• Review and sanitize user-controlled input to AI chat responses
• Implement Content Security Policy (CSP) to restrict script execution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-26T15:16:27.710Z and has not been modified since then. The NVD entry is currently 8.1 HIGH. This vulnerability affects NoteGen before version 0.32.0, allowing attackers to execute arbitrary JavaScript in the application context. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.