← Back to the live CVE advisory feed

CVE-2026-17497: NoteGen

Severity

8.3 (HIGH)

Vendor

CODEXU

Affected versions

All versions of NoteGen prior to 0.32.0

Fixed version

0.32.0

Patch status

Patched

Published

2026-07-26T15:16:27.873

Modified

2026-07-26T15:16:27.873

Why it matters

This vulnerability poses a critical risk as it allows for full remote code execution on a user's machine. If combined with a script injection vulnerability (like XSS) in the application webview, an attacker could execute arbitrary operating system commands, leading to complete system compromise, dat

Recommended admin actions

• Identify all instances of NoteGen deployed in your environment.
• Immediately upgrade NoteGen to version 0.32.0 or later.
• Review application webview configurations for potential script injection vectors (e.g., XSS).
• Monitor systems running NoteGen for any unusual process activity or unauthorized commands.

Technical summary

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

View the official NVD record for CVE-2026-17497

AI-enriched (HIGH confidence). Validate against the vendor advisory before taking production action.