Note-mark versions prior to 0.19.2 have an XSS vulnerability due to improper content type handling in the asset delivery handler. Uploaded files are served inline with empty Content-Type headers and without the X-Content-Type-Options: nosniff header, enabling browsers to interpret and execute active content like JavaScript in HTML or SVG files. An authenticated user can exploit this by uploading a malicious note asset containing script code. When another user visits the asset URL, the script runs in the context of the application, potentially compromising the victim's session and API privileges. The vulnerability is tracked as CVE-2026-40262 with a CVSS 3.1 score of 8.7 (high severity). The issue has been resolved in note-mark version 0.19.2.

Successful exploitation allows an attacker with authenticated access to upload malicious HTML or SVG files that execute arbitrary JavaScript in the context of the application when accessed by other users. This can lead to theft of authenticated session tokens and unauthorized API actions, compromising user accounts and application integrity. The vulnerability does not affect availability but has high confidentiality and integrity impact.

This vulnerability has been fixed in note-mark version 0.19.2. Users and administrators should upgrade to version 0.19.2 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the vendor's release notes indicating the fix in version 0.19.2.