CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5.

• CWE-20
• CWE-22

• https://github.com/enchant97/note-mark/commit/67b7de04308a858ef27ceff87b514067b6d667e5
• https://github.com/enchant97/note-mark/releases/tag/v0.19.5
• https://github.com/enchant97/note-mark/security/advisories/GHSA-rqrh-8wpv-x7hh
• https://github.com/enchant97/note-mark/security/advisories/GHSA-rqrh-8wpv-x7hh

Published

Sep 4, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50548Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-50549Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-5055NoMachine Uncontrolled Search Path Element Local Privilege E…7.8
• CVE-2026-50550Snipe-IT is an IT asset/license management system. Prior to …5.8
• CVE-2026-50551SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-50552Koel is a free, open-source music streaming solution. Prior …6.3
• CVE-2026-50554Note Mark is an open-source note-taking application. Prior t…5.3
• CVE-2026-50555Angular is a development platform for building mobile and de…6.1
• CVE-2026-50556Angular is a development platform for building mobile and de…6.1
• CVE-2026-50557Angular is a development platform for building mobile and de…6.1
• CVE-2026-50558Penelope Shell Handler is a post-exploitation shell handler …5.9
• CVE-2026-50559Quarkus is a Java framework for building cloud-native applic…7.5