{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-17497", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-07-26T14:37:51.448Z", "datePublished": "2026-07-26T14:38:08.960Z", "dateUpdated": "2026-07-27T14:49:03.628Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-07-26T14:38:08.960Z" }, "title": "NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE" } ] }, { "descriptions": [ { "lang": "en", "cweId": "CWE-1249", "description": "CWE-1249 Application-Level admin tool with inconsistent view of underlying operating system", "type": "CWE" } ] }, { "descriptions": [ { "lang": "en", "cweId": "CWE-276", "description": "CWE-276 Incorrect default permissions", "type": "CWE" } ] } ], "impacts": [ { "capecId": "CAPEC-242", "descriptions": [ { "lang": "en", "value": "CAPEC-242 Code Injection" } ] }, { "capecId": "CAPEC-549", "descriptions": [ { "lang": "en", "value": "CAPEC-549 Local Execution of Code" } ] }, { "capecId": "CAPEC-17", "descriptions": [ { "lang": "en", "value": "CAPEC-17 Using Malicious Files" } ] } ], "affected": [ { "vendor": "codexu", "product": "NoteGen", "collectionURL": "https://github.com/codexu/note-gen", "packageName": "note-gen", "repo": "git://github.com/codexu/note-gen", "programFiles": [ "src-tauri/capabilities/default.json", "src-tauri/capabilities/desktop.json" ], "versions": [ { "status": "affected", "version": "0", "lessThan": "0.32.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

" } ] } ], "references": [ { "url": "https://github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f", "name": "Fix: remove unrestricted shell execute for bash/python; harden skill script execution", "tags": [ "patch" ] }, { "url": "https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0", "name": "NoteGen v0.32.0 release", "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/codexu/note-gen", "name": "NoteGen repository", "tags": [ "product" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" } } ], "configurations": [ { "lang": "en", "value": "Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Affects the NoteGen desktop application on a default installation. Exploitation requires the ability to run script in the NoteGen webview (for example via a separate XSS issue) and then invoke the Tauri shell execute API. No non-default capability configuration is required on affected versions.

" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Upgrade to NoteGen 0.32.0 or later. The fix removes shell:allow-execute entries that permitted bash, python, and python3 with attacker-controlled arguments from the default Tauri capabilities, closing the webview-to-OS command execution path.

" } ] } ], "exploits": [ { "lang": "en", "value": "A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke('plugin:shell|execute', { program: 'bash', args: ['-c', ''], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

A proof of concept obtains JavaScript execution in the webview (via malicious skill-driven chat XSS) and then calls window.__TAURI__.core.invoke('plugin:shell|execute', { program: 'bash', args: ['-c', '<command>'], ... }) to open Calculator and exfiltrate local files to an attacker-controlled server.

" } ] } ], "timeline": [ { "time": "2026-06-08T00:00:00.000Z", "lang": "en", "value": "Vulnerability discovered and PoC verified" }, { "time": "2026-07-20T00:00:00.000Z", "lang": "en", "value": "Fix released in NoteGen v0.32.0 (shell capability lockdown)" } ], "credits": [ { "lang": "en", "value": "Yuval Moravchick", "type": "finder" }, { "lang": "en", "value": "JFrog Security Research", "type": "coordinator" } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.4" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-07-27T14:48:49.754931Z", "id": "CVE-2026-17497", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T14:49:03.628Z" } } ] } }