CVE-2026-50553

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.5

Description An authenticated user can perform a path traversal attack by providing a specially crafted slug value when creating a book or note. The application uses an unanchored regular expression [a-z0-9-]+ for validation, which allows strings containing traversal sequences like ../ to be accepted and stored if they contain at least one alphanumeric character.

When an administrator executes the data-export CLI commands note-mark migrate export or note-mark migrate export-v1, these unsanitized slug values are joined into the output file path. This allows the exporter to create directories and write files (specifically index.md) to arbitrary locations on the filesystem outside the intended export directory. If the export process is run with root privileges, this can lead to remote code execution by writing malicious files to system startup paths such as /etc/cron.d/.

Recommendations Update Note Mark to a version later than 0.19.4. As a temporary mitigation, avoid running the note-mark migrate export or note-mark migrate export-v1 commands with root privileges. Restrict the creation of books and notes with slug values containing traversal characters like ../ until the update is applied.