CVE-2026-17497

Name of the Vulnerable Software and Affected Versions NoteGen versions prior to 0.32.0

Description NoteGen grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. This allows JavaScript running in the application webview to invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. When combined with script execution in the webview, such as through chat XSS (Cross-Site Scripting, a technique where malicious scripts are injected into trusted websites), this can lead to full remote code execution on the user's machine.

Recommendations Update NoteGen to version 0.32.0 or later.