A cross‑site scripting flaw exists in the Note Editor component of sheshbabu zen. The vulnerability is triggered by an unsafe use of dangerouslySetInnerHTML in the NotesEditor.jsx file, allowing an attacker to inject arbitrary HTML or JavaScript into the editor’s content rendering path. If an attacker can submit a crafted note, the embedded script will execute in the victim’s browser, potentially stealing session cookies, executing phishing attacks, or hijacking the user’s session. This issue is categorized as CWE‑79 and involves improper code evaluation, CWE‑94.

The affected product is sheshbabu zen, version 1.5.0 and earlier. The flaw resides in the Note Editor feature located at features/notes/NotesEditor.jsx within the vendor’s codebase. Users running any release up to and including 1.5.0 are considered vulnerable.

The CVSS score is 5.1, indicating medium severity. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, yet an exploit has been publicly disclosed and is functional. Attackers can initiate the flaw remotely by delivering a malicious note via the editor, so the risk remains moderate but persistent until a vendor patch is released.