---
id: CVE-2026-17496
title: >-
  NoteGen before 0.32.0 renders AI chat responses with markdown-it configured
  with html:true and injects the result into the DOM via dangerouslySetInnerHTML
  in chat-preview, without HTML sanitization and with CSP set to null
summary: >-
  NoteGen before 0.32.0 renders AI chat responses with markdown-it configured
  with html:true and injects the result into the DOM via dangerouslySetInnerHTML
  in chat-preview, without HTML sanitization and with CSP set to null.
  Attacker-cont…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-07-26'
updated: '2026-07-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17496'
references:
  - url: 'https://github.com/codexu/note-gen'
    label: reefs@jfrog.com
  - url: >-
      https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298
    label: reefs@jfrog.com
  - url: 'https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0'
    label: reefs@jfrog.com
tags:
  - nvd
ingestedAt: '2026-07-26T16:12:18.577Z'
epss: 0.00547
epssPercentile: 0.43472
---

## Overview

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.