Unsanitized AI-Generated HTML Enables DOM-Based XSS in NoteGen

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

NoteGen versions before 0.32.0 contain a critical cross-site scripting vulnerability where AI-generated chat responses are rendered as HTML without sanitization. The vulnerability stems from markdown-it being configured with html:true, responses injected via dangerouslySetInnerHTML, and Content Security Policy disabled entirely. This allows attackers to craft malicious skill REFERENCE.md files that manipulate the AI model into generating executable markup—such as img tags with onerror handlers—that execute in the user's browser when viewing chat responses. Organizations using NoteGen for security skill training and threat analysis are directly affected, as attackers can poison the skill knowledge base to compromise analyst systems during normal workflow interactions.

Casky's 322 matching skills leverage Claude's extended reasoning to detect the attack chain mapped to TA0001 (Reconnaissance) and TA0043 (Reconnaissance targeting) by analyzing how adversaries profile and manipulate AI system prompts. Practitioners using Casky would observe findings that identify: (1) suspicious REFERENCE.md content patterns designed to trigger HTML generation in LLM outputs, (2) dangerous markdown-it configurations combined with null CSP headers, and (3) DOM injection patterns using dangerouslySetInnerHTML without prior sanitization. The skill correlation reveals the full attack surface—from initial skill poisoning through browser exploitation—enabling security teams to audit both their AI-integrated tools and the external content fed into them, substantially reducing the window for AI-assisted XSS attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-17496.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-17496

Casky has 322 skills that investigate the attack patterns behind CVE-2026-17496. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn