{"id":"GHSA-9pr4-rf97-79qh","revision":null,"records":[{"revision":"bc9d376beb6149cb976eedcd6bdb3b1b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40262","aliases":[],"title":"Note Mark has Stored XSS via Unrestricted Asset Upload","description":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.","state":0,"publishedAt":"2026-04-16T23:51:38.679+00:00","modifiedAt":"2026-04-18T02:51:02.474+00:00","affected":[{"ecosystem":"Vendor product","name":"note-mark","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"enchant97\",\n                    \"product\": \"note-mark\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.19.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh","https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3","https://github.com/enchant97/note-mark/releases/tag/v0.19.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40262","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40262","identifiers":["CVE-2026-40262"]},"retained":false,"historicalAffected":[]},{"revision":"14cf5da5eaac4ceb8bae65917e319cef","observedAt":"2026-10-28T05:01:44.721+00:00","statement":{"source":"euvd","id":"EUVD-2026-23332","aliases":["CVE-2026-40262","GHSA-9pr4-rf97-79qh"],"title":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such …","description":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":null}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh","https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3","https://github.com/enchant97/note-mark/releases/tag/v0.19.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23332","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 16, 2026, 11:51:38 PM","dateUpdated":"Apr 18, 2026, 2:51:02 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-23332","identifiers":["EUVD-2026-23332","CVE-2026-40262","GHSA-9pr4-rf97-79qh"]},"retained":false,"historicalAffected":[]},{"revision":"3cf92efa5dda469fbf194d7f08c9a666","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40262","aliases":[],"title":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such …","description":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.","state":0,"publishedAt":"2026-04-17T01:17:39.95+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3","https://github.com/enchant97/note-mark/releases/tag/v0.19.2","https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40262","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79","CWE-434"],"productCriteria":[],"sourceDates":{"published":"2026-04-17T01:17:39.950","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40262","identifiers":["CVE-2026-40262"]},"retained":false,"historicalAffected":[]},{"revision":"c73656b00db940b6bb3ff67d4b9fac83","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9pr4-rf97-79qh","aliases":["CVE-2026-40262","GO-2026-5295"],"title":"Note Mark has Stored XSS via Unrestricted Asset Upload","description":"### Summary\nA stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without `nosniff`, browsers can sniff and render active content, giving the attacker access to authenticated Note Mark API actions as the victim.\n\n### Details\nThis issue results from three compounding flaws in the asset handling and delivery path.\n\n#### 1. Asset delivery can be used as an attack vector\nThe asset delivery route can be used to deliver attacker-controlled uploaded content directly to a victim by URL.\n\nRelevant route:\n- `handlers/assets.go:40`\n\n```go\nhuma.Get(api, \"/api/notes/{noteID}/assets/{assetID}\", h.GetNoteAssetContentByID)\n```\n\nThis makes the uploaded asset reachable by direct navigation, which provides the delivery mechanism for the payload.\n\n#### 2. Text-based active content is served with an empty `Content-Type`\nThe asset handler relies on `h2non/filetype` for content-type detection:\n\n- `handlers/assets.go:147`\n\n```go\nkind, _ := filetype.Match(buf)\nif kind != filetype.Unknown {\n    contentType = kind.MIME.Value\n}\n```\n\nThe detection library uses magic-byte matching and does not identify text-based formats such as HTML, SVG, JavaScript, XML, or XHTML. For those files, `filetype.Match` returns `Unknown`, leaving `Content-Type` unset or empty.\n\nAs a result, uploaded active content is served without an authoritative MIME type.\n\n#### 3. Files are rendered inline and sniffed by the browser\nThe asset response is sent with inline disposition:\n\n- `handlers/assets.go:153`\n\n```go\nw.Header().Set(\"Content-Disposition\", fmt.Sprintf(\"inline; filename=\\\"%s\\\"\", asset.Name))\n```\n\nAt the same time, the response does not set:\n\n```http\nX-Content-Type-Options: nosniff\n```\n\nThis combination is dangerous:\n- the uploaded file contains attacker-controlled active markup\n- the browser is instructed to render it inline\n- the response does not provide a trustworthy content type\n- content sniffing is not disabled\n\nUnder these conditions, browsers may detect HTML or SVG content and execute embedded JavaScript. Because the asset is served from the application’s own origin, the script runs with same-origin access to the application and its authenticated APIs.\n\nThis turns an uploaded asset into a stored XSS payload that executes when a victim opens the asset URL.\n\n### PoC\nThe issue can be reproduced by uploading a text-based active content file such as HTML or SVG as a note asset, then opening the served asset URL in a browser and observing that script executes in the context of the application origin.\n\n### Impact\n- **Type:** Stored same-origin cross-site scripting (XSS)\n- **Who is impacted:** Any user who can be induced to open a malicious asset URL, and any deployment allowing asset uploads\n- **Security impact:** An attacker can execute JavaScript in the victim’s authenticated application context, allowing access to private notes, books, profile data, and authenticated API actions\n- **Privileges required:** A valid low-privilege user account capable of uploading note assets\n- **User interaction:** Required, because the victim must navigate to the malicious asset URL\n- **Scope:** Changed, because attacker-controlled content executes in the victim’s origin and impacts other users rather than remaining confined to the attacker’s own account","state":0,"publishedAt":"2026-04-13T19:23:08+00:00","modifiedAt":"2026-06-25T19:56:17.5046139+00:00","affected":[{"ecosystem":"Go","name":"github.com/enchant97/note-mark/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260411145018-6bb62842ccb9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh","https://nvd.nist.gov/vuln/detail/CVE-2026-40262","https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3","https://github.com/enchant97/note-mark","https://github.com/enchant97/note-mark/releases/tag/v0.19.2"],"sourceUrl":"https://github.com/advisories/GHSA-9pr4-rf97-79qh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9pr4-rf97-79qh","identifiers":["GHSA-9pr4-rf97-79qh","CVE-2026-40262","GO-2026-5295"]},"retained":false,"historicalAffected":[]},{"revision":"8cbc217a54974fcaabc7da3f06eccd72","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5295","aliases":["CVE-2026-40262","GHSA-9pr4-rf97-79qh"],"title":"Note Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend","description":"Note Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-06-25T19:45:27.576613+00:00","affected":[{"ecosystem":"Go","name":"github.com/enchant97/note-mark/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260411145018-6bb62842ccb9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh","https://nvd.nist.gov/vuln/detail/CVE-2026-40262","https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3","https://github.com/enchant97/note-mark/releases/tag/v0.19.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5295","license":"OSV · upstream source license applies","key":"osv:GO-2026-5295","identifiers":["GO-2026-5295","CVE-2026-40262","GHSA-9pr4-rf97-79qh"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6546169+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6546176+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":416807,"lastAttemptAt":"2026-10-30T01:48:54.7743429+00:00","lastSuccessAt":"2026-10-30T00:54:38.6858592+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.7743429+00:00","snapshotPublishedAt":"2026-10-30T01:29:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-824f5092797940c08129032fcab8f0dd","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T02:01:05.0861472+00:00","lastSuccessAt":"2026-10-30T02:01:05.08+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T02:01:05.08+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13587,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6554576+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6554578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T01:48:56.2261206+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T01:48:55.2317852+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.2317852+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T01:48:54.9356382+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.9356382+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T01:48:55.4168216+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.4168216+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T01:48:55.0481567+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.0481567+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}