Dashboard / CVE-2026-17497

CVE-2026-17497

HIGH
MEDIUM Priority: 0.06 BB Relevance: 57/100
Published: 2026-07-26 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Required
S: Changed
C: High
I: High
A: High

Description

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

Weakness Classification (3)

Affected Software (1)

VendorProductVersion
notegen notegen < 0.32.0

References & Advisories (3)

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ No authentication

CVSS Score

8.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.75%
Raw Score 0.007490
Percentile 54.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00749
2026-10-28
0.00749

Intelligence Sources

nvd ref →

External Links