CVE-2026-17497 - NoteGen Arbitrary OS Command Execution via Tauri Shell
CVE-2026-17497 - NoteGen Arbitrary OS Command Execution via Tauri Shell
Overview
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. This flaw, identified as CVE-2026-17497, allows for arbitrary OS command execution via Tauri shell:allow-execute. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview, for example via chat XSS, this enables full remote code execution on the user’s machine. 🚨
Affected Products
The following products are affected by the CVE-2026-17497 vulnerability:
- NoteGen versions prior to 0.32.0
Mitigation
To address this vulnerability, update NoteGen to version 0.32.0 or later to fix the shell execution vulnerability. Additional recommendations include:
- Reviewing and restricting shell plugin capabilities.
- Implementing input sanitization for webview scripts.
- Disabling unnecessary shell commands.
Associated CWEs
CVE-2026-17497 is associated with the following CWEs:
- CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
- CWE-276: Incorrect Default Permissions
- CWE-1249: Application-Level Admin Tool with Inconsistent View of Underlying Operating System
Common Attack Patterns
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-17497 weaknesses. The CAPEC entries associated with this vulnerability include:
- CAPEC-6: Argument Injection
- CAPEC-15: Command Delimiters
- CAPEC-43: Exploiting Multiple Input Interpretation Layers
- CAPEC-88: OS Command Injection
- CAPEC-108: Command Line Execution through SQL Injection
For more details, please refer to the Read full article.