NoteGen is vulnerable to Chat Preview XSS via Unsanitized AI/Skill HTML Rendering

NoteGen before version 0.32.0 is vulnerable to a stored cross-site scripting (XSS) attack via unsanitized HTML rendering of AI chat responses, allowing arbitrary JavaScript execution in the Tauri webview. The vulnerability, identified in the chat-preview component, stems from markdown-it configured with html:true and dangerouslySetInnerHTML without sanitization, with CSP set to null. Attackers can craft a malicious skill's REFERENCE.md to instruct the model to emit HTML, such as an img onerror payload, which executes when the user views the chat response. The fix in version 0.32.0 replaces the vulnerable rendering with Streamdown-based sanitization.

Summary summary NoteGen is vulnerable to Chat Preview XSS via Unsanitized AI/Skill HTML Rendering Component component note-gen NoteGen Affected versions affected-versions < 0.32.0 Description description NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt, for example a malicious skill REFERENCE.md that instructs the model to emit HTML, can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context. PoC poc Step 1 - Install a malicious skill Copy a skill whose REFERENCE.md instructs the model to wrap responses in an HTML container that includes a hidden img onerror payload into the NoteGen skills directory, for example: cp -r writing-assistant ~/Library/Application\ Support/com.codexu.NoteGen/skills/ A minimal REFERENCE.md payload shape: <div class="wa-response" content <img src="wa-1.2.0" onerror="alert 1 " style="display:none" alt="" </div Step 2 - Launch NoteGen and open chat Use a clean default installation of NoteGen < 0.32.0 with an AI model configured. Confirm the skill appears in the skills list. Step 3 - Trigger the skill in chat Start a new chat and ask the model to use the skill, for example: "use the writing-assistant skill to write me a project delay email". Step 4 - Verify script execution in the webview When the model response is rendered in chat-preview, the img onerror handler runs in the NoteGen Tauri webview. Expected proof: the alert or other chosen JavaScript side effect fires while the user only sees a normal-looking chat reply. Vulnerability Mitigations vulnerability-mitigations Upgrade to NoteGen 0.32.0 or later. The fix replaces unsanitized markdown-it HTML injection in chat preview with Streamdown-based rendering that hardens and sanitizes untrusted HTML in model output. References references https://github.com/advisories/GHSA-gwhc-vprp-gfcg https://github.com/advisories/GHSA-gwhc-vprp-gfcg https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298 https://github.com/codexu/note-gen/commit/ae3ba948c41d8a74b4a20f4c6f26fcdda2002298 https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0 https://github.com/codexu/note-gen/releases/tag/note-gen-v0.32.0