CVE-2026-17496: NoteGen chat preview XSS via unsanitized HTML rendering before 0.32.0
CVE-2026-17496 is verified against note-gen · github affected versions: NoteGen before 0.32.0 fixed version: 0.32.0 vulnerability class: XSS This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00304.
pruva-verify REPRO-2026-00304 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00304/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Primary-source brief (manual researched): NVD states NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that induces the model to emit HTML) can cause executable markup such as an img onerror handler, leading to XSS in the privileged Tauri webview. Upstream references point to NoteGen commit ae3ba948c41d8a74b4a20f4c6f26fcdda2002298 and release note-gen-v0.32.0. Reproduction goal for the pipeline: independently prove this CVE's own chat-preview XSS claim using the real UI path and compare vulnerable vs fixed behavior; do not conflate with CVE-2026-17497 or invent a broader exploit.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.