CVE-2026-17497 is an OS command injection vulnerability in NoteGen before version 0.32.0. The application grants the Tauri shell plugin the shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in its default desktop capabilities. This enables JavaScript running within the NoteGen webview to invoke plugin:shell|execute and run attacker-controlled OS commands with the same privileges as the NoteGen process. When combined with script execution vulnerabilities such as chat XSS, this can lead to full remote code execution on the affected system.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the NoteGen process. This can lead to complete compromise of the user's machine, including confidentiality, integrity, and availability impacts. The vulnerability is exploitable remotely if the attacker can inject or execute scripts in the application's webview environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running vulnerable versions of NoteGen and restrict untrusted JavaScript execution within the application webview. Monitor vendor channels for updates and apply patches promptly once released.