CVE-2026-40262 is a high-severity cross-site scripting vulnerability in the open-source note-taking application Note Mark (enchant97 project). In versions prior to 0.19.2, the asset delivery handler serves uploaded files inline relying on magic-byte detection, which fails to identify text-based formats like HTML or SVG. These files are served with an empty Content-Type header and without the X-Content-Type-Options: nosniff header, enabling browsers to sniff and execute active content. An authenticated attacker can upload malicious HTML or SVG files containing JavaScript, which executes when a victim accesses the asset URL, compromising the victim's authenticated session and API access. The issue is resolved in version 0.19.2.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim user's session. This can lead to session hijacking and unauthorized API actions under the victim's privileges. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Upgrade Note Mark to version 0.19.2 or later, where this vulnerability is fixed. The fix addresses proper content-type handling and adds the X-Content-Type-Options: nosniff header to prevent browsers from executing malicious content. No other mitigation is indicated by the vendor advisory.