NoteGen: AI Output Rendered as Raw HTML → RCE
On this page
Render the model's markdown as raw HTML in a desktop app, and XSS becomes code execution on the host.
| When | July 2026 |
|---|---|
| Target | NoteGen (Tauri + React AI note app) |
| Vendor | NoteGen (open source) |
| Technique | Raw-HTML render of model output (dangerouslySetInnerHTML, null CSP) |
| CVE | CVE-2026-17496 (XSS, 8.1) → chained with CVE-2026-17497 for RCE |
- 1NoteGen renders AI chat output via markdown-it (html:true) + dangerouslySetInnerHTML
- 2Poisoned content makes the model emit active markup; there's no sanitiser, CSP is null
- 3In the privileged Tauri webview the XSS chains with a shell-exec permission (CVE-2026-17497) to reach RCE
What happened
NoteGen rendered AI chat responses by running them through markdown-it configured with html: true and injecting the result into the DOM via dangerouslySetInnerHTML — with no HTML sanitiser and CSP set to null. Content that reached the prompt (e.g. via a poisoned skill file) could make the model emit markup that executed as JavaScript inside the privileged Tauri webview (the XSS, CVE-2026-17496). Chained with a Tauri shell-execute permission (CVE-2026-17497), that script reaches host commands — arbitrary code execution. Both were fixed in v0.32.0.
How it worked
Model output was rendered as raw HTML with no sanitisation and no CSP, so script in that output ran in a desktop webview that can reach host capabilities — turning XSS into RCE.
Root cause
Treating model output as safe HTML and disabling the browser's own defence (CSP) — the improper-output-handling mistake at its most dangerous.
What a test would have caught
Feeding markup through the model and checking whether it renders/executes as HTML in the app surfaces the XSS — and, in a desktop webview, the RCE escalation.
How to prevent it
- Sanitise model output; never render it as raw HTML.
- Keep a strict CSP; don't disable it.
- In desktop webviews, treat XSS as RCE and defend accordingly.
Feel it yourselfThe replay lab renders raw model-generated HTML into a page — the output-handling class behind NoteGen.
FAQ
How does XSS become RCE here?
The AI output was rendered as raw HTML inside a Tauri desktop webview with no sanitiser and a null CSP — that is the XSS (CVE-2026-17496). Chained with a Tauri shell-execute permission (CVE-2026-17497), script in that privileged webview reaches host commands, so the XSS escalates to full code execution on the machine.
How did attacker content reach the model?
Via poisoned content (e.g. a skill's REFERENCE.md) that entered the prompt — the model then emitted markup that the app rendered unsafely.
What was the fix?
v0.32.0 sanitises/renders AI output safely rather than injecting it as raw HTML — treat model output as untrusted, and don't disable CSP.
Sources
- CVE-2026-17496 — OSV.dev
- NoteGen release v0.32.0 (fix) — codexu/note-gen (GitHub)
- CVE-2026-17496 Detail — NVD