CVE-2026-17496 is a cross-site scripting vulnerability in codexu NoteGen before version 0.32.0. The vulnerability arises because AI chat responses are rendered using markdown-it with html:true enabled and injected into the DOM via dangerouslySetInnerHTML without any HTML sanitization. Additionally, the CSP is set to null, providing no mitigation against script execution. An attacker can craft input that reaches the AI model prompt (such as a malicious skill REFERENCE.md) that instructs the model to emit executable HTML markup, including event handlers like img onerror. When the user views the chat response, this markup executes as JavaScript within the application's privileged Tauri webview context, enabling arbitrary script execution and thus cross-site scripting.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the privileged context of the NoteGen application. This can lead to compromise of user data, unauthorized actions within the app, and potential further exploitation of the user's environment. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or attacker-controlled content that could influence AI model prompts. Implementing HTML sanitization on rendered AI responses and enforcing a strict Content Security Policy are recommended mitigations once patches are released.