What happened
NVD published CVE-2026-17496 (CVSS 8.1, High) on 2026-07-26. NoteGen is a desktop AI note-taking app built on Tauri; because rendered AI responses are inserted unsanitized into a privileged desktop webview, indirect prompt injection (via a poisoned skill/reference file) can achieve arbitrary script execution with the application's own privileges.
Why it matters
This is a clean example of prompt-injection-to-XSS-to-native-app-compromise: content controlled by an untrusted third party (a shared 'skill' file) that reaches the LLM's context can be laundered into code execution inside a desktop application, going beyond typical browser-sandboxed XSS. Blast radius is limited to NoteGen's single-author user base, so it is a low-blast-radius but architecturally instructive precision finding.
Attack vector
NoteGen renders AI chat responses using markdown-it configured with html:true, injecting the output via dangerouslySetInnerHTML into the chat-preview component with CSP disabled. Attacker-controlled content that reaches the model prompt (e.g., a malicious skill REFERENCE.md file processed by the agent) can cause the model's response to include executable HTML/JS (e.g., img onerror handlers), which then executes inside the privileged Tauri desktop webview when the user views the response.
Affected systems
NoteGen before 0.32.0
Mitigation
Upgrade to NoteGen 0.32.0 or later, which sanitizes rendered markdown and restores CSP.