PT-2026-32118 · Note Mark · Note Mark

Published

2026-04-11

·

Updated

2026-04-17

·

CVE-2026-40262

CVSS v3.1

8.7

High

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.2
Description A stored same-origin cross-site scripting (XSS) issue exists where the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type. This method fails to identify text-based formats such as HTML, SVG, or XHTML, resulting in files being served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition. Consequently, browsers may sniff and render active content. An authenticated user can upload a malicious HTML or SVG file containing JavaScript as a note asset via the endpoint '/api/notes/{noteID}/assets/{assetID}'. When a victim navigates to the asset URL, the script executes under the application origin, granting access to the victim's authenticated session and API actions.
Recommendations Update to version 0.19.2.

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434CWE-79

Related Identifiers

CVE-2026-40262
GHSA-9PR4-RF97-79QH

Affected Products

Note Mark