Note Mark has Stored XSS via Unrestricted Asset Upload

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.

Source published

16 Apr 2026 23:51:38 UTC

Source modified

18 Apr 2026 02:51:02 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.

Source published

Apr 16, 2026, 11:51:38 PM (timezone not stated)

Source modified

Apr 18, 2026, 2:51:02 AM (timezone not stated)

Observed here

28 Oct 2026 05:01:44 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.

Source published

17 Apr 2026 01:17:39 UTC

Source modified

26 Oct 2026 21:10:00 UTC

Observed here

27 Oct 2026 10:09:56 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

### Summary A stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without `nosniff`, browsers can sniff and render active content, giving the attacker access to authenticated Note Mark API actions as the victim. ### Details This issue results from three compounding flaws in the asset handling and delivery path. #### 1. Asset delivery can be used as an attack vector The asset delivery route can be used to deliver attacker-controlled uploaded content directly to a victim by URL. Relevant route: - `handlers/assets.go:40` ```go huma.Get(api, "/api/notes/{noteID}/assets/{assetID}", h.GetNoteAssetContentByID) ``` This makes the uploaded asset reachable by direct navigation, which provides the delivery mechanism for the payload. #### 2. Text-based active content is served with an empty `Content-Type` The asset handler relies on `h2non/filetype` for content-type detection: - `handlers/assets.go:147` ```go kind, _ := filetype.Match(buf) if kind != filetype.Unknown { contentType = kind.MIME.Value } ``` The detection library uses magic-byte matching and does not identify text-based formats such as HTML, SVG, JavaScript, XML, or XHTML. For those files, `filetype.Match` returns `Unknown`, leaving `Content-Type` unset or empty. As a result, uploaded active content is served without an authoritative MIME type. #### 3. Files are rendered inline and sniffed by the browser The asset response is sent with inline disposition: - `handlers/assets.go:153` ```go w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s\"", asset.Name)) ``` At the same time, the response does not set: ```http X-Content-Type-Options: nosniff ``` This combination is dangerous: - the uploaded file contains attacker-controlled active markup - the browser is instructed to render it inline - the response does not provide a trustworthy content type - content sniffing is not disabled Under these conditions, browsers may detect HTML or SVG content and execute embedded JavaScript. Because the asset is served from the application’s own origin, the script runs with same-origin access to the application and its authenticated APIs. This turns an uploaded asset into a stored XSS payload that executes when a victim opens the asset URL. ### PoC The issue can be reproduced by uploading a text-based active content file such as HTML or SVG as a note asset, then opening the served asset URL in a browser and observing that script executes in the context of the application origin. ### Impact - **Type:** Stored same-origin cross-site scripting (XSS) - **Who is impacted:** Any user who can be induced to open a malicious asset URL, and any deployment allowing asset uploads - **Security impact:** An attacker can execute JavaScript in the victim’s authenticated application context, allowing access to private notes, books, profile data, and authenticated API actions - **Privileges required:** A valid low-privilege user account capable of uploading note assets - **User interaction:** Required, because the victim must navigate to the malicious asset URL - **Scope:** Changed, because attacker-controlled content executes in the victim’s origin and impacts other users rather than remaining confined to the attacker’s own account

Source published

13 Apr 2026 19:23:08 UTC

Source modified

25 Jun 2026 19:56:17 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Publisher rating · HIGH

Note Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend

Source published

25 Jun 2026 18:43:19 UTC

Source modified

25 Jun 2026 19:45:27 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.