Threat Intelligence Database

Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.

CVE-2026-44523 affects the open-source note-taking application Note Mark prior to version 0.19.4. The vulnerability arises because the application does not enforce a minimum length or entropy requirement on the JWT_SECRET configuration value, allowing very weak secrets, including those as short as one byte. This inadequate encryption strength can compromise confidentiality and integrity of JWT tokens. The issue is fixed in version 0.19.4. The vulnerability has a critical CVSS score of 10. No known exploits are reported in the wild.

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries. This issue has been patched in version 0.19.3.

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

Note Mark versions 0.19.1 and earlier have a missing authorization vulnerability in the asset download endpoint. This flaw allows unauthenticated users who know valid note and asset IDs to access private note assets without any authentication or ownership verification. The issue is fixed in version 0.19.2.

CVE-2026-40263 is a timing discrepancy vulnerability in the open-source note-taking application Note Mark, versions 0.19.1 and earlier. The login endpoint only performs bcrypt password verification when the username exists, returning immediately for nonexistent usernames. This behavior allows unauthenticated attackers to enumerate valid usernames by measuring response times. The issue has been fixed in version 0.19.2. The vulnerability has a low CVSS score of 3.7 and does not impact integrity or availability.

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.