The vulnerability in NoteGen occurs because the chat preview component renders AI‑generated responses using markdown‑it with HTML enabled and injects the output directly into the DOM via dangerouslySetInnerHTML. This process lacks any HTML sanitization and the page sets the Content‑Security‑Policy to null. When an attacker supplies content that influences the AI model prompt—such as a crafted skill or REFERENCE.md file—they can cause the model to emit malicious HTML containing executable payloads (for example, an img element with an onerror handler). Viewing the chat response in the privileged Tauri webview then executes that payload, granting arbitrary script execution within the application context.

All installations of NoteGen older than version 0.32.0 are vulnerable, regardless of operating system or platform. Any instance that has not applied the 0.32.0 release is at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score of < 1% suggests exploitation is considered unlikely in the wild, and the vulnerability is not listed in CISA KEV. Attack requires the attacker to supply malicious skill or other input that can reach the model prompt; once the user views the harmful chat response, arbitrary code executes within the application, posing a significant threat to confidentiality, integrity, and availability. The likely attack vector is via a malicious skill that the user may load or run within NoteGen, though the vulnerability is tied to local user actions and not a remote network interface.