PT-2026-64812 · Codexu · Notegen

Yuval Moravchick · CVE-2026-17497 · Publicado 2026-07-26 · Atualizado 2026-07-26

NVD

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

Correção

Incorrect Default Permissions

OS Command Injection

Enumeração de Fraquezas

CWE-276

CWE-78

CWE-1249

Identificadores relacionados

CVE-2026-17497

Produtos afetados

Notegen

Referências · 4

• https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0 · Aviso do Fabricante
• https://github.com/codexu/note-gen · Nota
• https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-17497 · Nota de Segurança