CVE-2026-40262

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.

• CWE-79
• CWE-434

• https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3
• https://github.com/enchant97/note-mark/releases/tag/v0.19.2
• https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40257OP-TEE is a Trusted Execution Environment (TEE) designed as …5.5
• CVE-2026-40258The Gramps Web API is a Python REST API for the genealogical…9.1
• CVE-2026-40259SiYuan is an open-source personal knowledge management syste…8.1
• CVE-2026-4026A security vulnerability has been identified in FlexNet Mana…8.7
• CVE-2026-40260pypdf is a free and open-source pure-python PDF library. In …5.3
• CVE-2026-40261Composer is a dependency manager for PHP. Versions 1.0 throu…8.8
• CVE-2026-40263Note Mark is an open-source note-taking application. In vers…3.7
• CVE-2026-40264OpenBao is an open source identity-based secrets management …2.7
• CVE-2026-40265Note Mark is an open-source note-taking application. In vers…5.9
• CVE-2026-4027A security vulnerability has been identified in FlexNet Mana…7.1
• CVE-2026-40272Improper Input Validation in the decode() function of the tr…7
• CVE-2026-40279BACnet Stack is a BACnet open source protocol stack C librar…3.7