NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111935 · Microsoft / collected KEV context

cve-program · CVE-2026-111935

• https://github.com/codexu/note-gen/issues/1296
• https://github.com/codexu/note-gen/commit/6840c13c4fcb71a79b7df838d19a026830d64b96
• https://github.com/codexu/note-gen/commit/64e671eb58f56ad6ebec0d99d32f6037f9319979
• https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/chat-image-context.ts
• https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/sync/conversation-sync.ts
• https://www.vulncheck.com/advisories/notegen-through-0.38.3-local-file-disclosure-via-chat-image-analysis

No related operational record is retained in the current change model.