NoteGen prior to version 0.38.3 allows an attacker who can write to the victim’s sync target to insert a path that points to a local file. During chat image analysis the application does not validate the source URL, meaning that the image_inspect routine will load the locally referenced image and forward it to an AI provider, effectively exposing the file’s contents. The flaw is an instance of external control of file path handling.

The vulnerability affects the NoteGen application distributed by codexu. Versions up to and including 0.38.3 are impacted; no other vendors or products are listed as affected.

The CVSS score for this issue is 2.1, indicating a low severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an attacker to have write access to the victim’s sync target; only then can absolute or file:// URLs be planted. When such a path is used, the image_inspect function sends the corresponding local image to an external AI provider, enabling sensitive file disclosure. Because the attacker must already have sync write privileges, the danger is limited to compromised or shared sync environments rather than arbitrary remote exploitation.