CVE-2026-17497

High

Description

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

SeverityHigh

CVSS8.3

Exploit probability—

ProductNotegen

PublishedJul 26, 2026

First seenJul 26, 2026

Weakness typeCWE-78OS command injection CWE-1249CWE-1249 CWE-276CWE-276

How to fix

Update

notegen notegen0.32.0 or later

Patches

github.com/codexu/note-gen/commit/00064a4a8ec4177d51094ffb3e15bf0758009c1f

Vendor advisories

github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0

Affected products

Product	Affected versions	Fixed in
notegen notegen	v < 0.32.0	0.32.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.