CVE-2026-17496 is a high-severity cross-site scripting vulnerability in codexu NoteGen before version 0.32.0. The vulnerability arises because AI chat responses are rendered using markdown-it with html:true enabled and injected into the DOM via dangerouslySetInnerHTML in the chat-preview component without any HTML sanitization. Additionally, the Content Security Policy is set to null, providing no protection. An attacker can supply malicious content that influences the AI model prompt (e.g., via a crafted skill REFERENCE.md) to produce executable HTML markup such as an img tag with an onerror handler. When the user views the chat response, this markup executes JavaScript in the privileged Tauri webview, enabling arbitrary script execution within the application context.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the privileged context of the NoteGen application’s Tauri webview. This can lead to compromise of the application, unauthorized actions, data theft, or other malicious activities. The vulnerability requires user interaction (viewing the malicious chat response) but does not require prior privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading untrusted or attacker-controlled content that could influence AI model prompts. Implementing proper HTML sanitization on AI chat responses and enforcing a strict Content Security Policy are recommended mitigations once a patch is released.