NVD nvd.nist.gov/vuln/detail/CVE-2026-17497

nvd.nist.gov • July 27, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Remote Code Execution Vulnerability in NoteGen (CVE-2026-17497) CVE-2026-17497 is a high-severity remote code execution vulnerability affecting NoteGen versions prior to 0.32.0. The flaw arises from an overly permissive Tauri shell plugin configuration that allows JavaScript in the application's webview to execute arbitrary OS commands. This can lead to full remote code execution on the user's machine if an attacker can execute scripts in the webview, such as through cross-site scripting. No public exploits have been reported yet, but the vulnerability poses a significant risk to users of affected versions. Organizations are advised to patch their systems promptly to mitigate potential exploitation. The vulnerability was published on July 26, 2026. 2 sources 71

Extracted Entities

NVD nvd.nist.gov/vuln/detail/CVE-2026-17497

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (2)

Vulnerabilities (1)