NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
Summary
| CVE | CVE-2026-111935 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-19 14:17:01 UTC |
| Updated | 2026-10-19 21:14:14 UTC |
| Description | NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider. |
Risk And Classification
Primary CVSS: v4.0 2.1 LOW from [email protected]
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-73 | CWE-73 External Control of File Name or Path
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.1 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 2.1 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 2.6 | LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| 3.1 | CNA | CVSS | 2.6 | LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighAttack Requirements
PresentPrivileges Required
LowUser Interaction
PassiveConfidentiality
LowIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.vulncheck.com/advisories/notegen-through-0.38.3-local-file-disclosure-via-c... | [email protected] | www.vulncheck.com | |
| github.com/codexu/note-gen/commit/64e671eb58f56ad6ebec0d99d32f6037f9319979 | [email protected] | github.com | |
| github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/sync/conversati... | [email protected] | github.com | |
| github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/chat-image-cont... | [email protected] | github.com | |
| github.com/codexu/note-gen/issues/1296 | [email protected] | github.com | |
| github.com/codexu/note-gen/commit/6840c13c4fcb71a79b7df838d19a026830d64b96 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: George Chen (en)
There are currently no legacy QID mappings associated with this CVE.