Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111935— NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis

Quick assessment

Affected
codexu NoteGen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NoteGen 0.38.3 及更早版本在聊天图像分析功能中存在文件路径外部控制漏洞。攻击者可通过未经验证的同步 sourceUrl 路径读取本地图像文件。若攻击者拥有对受害者同步目标的写入权限，可植入绝对路径或 file:// URL，导致 image_inspect 将本地图像发送至 AI 提供商。

CVSS 2.6 · Low

Affected Version Matrix 1

VendorProduct Version RangeStatus
codexu NoteGen ≤ 0.38.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111935

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
Source: CVE Program / CVE List V5
Vulnerability Description
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
codexu NoteGen 0 ~ 0.38.3 -

II. Public POCs for CVE-2026-111935

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111935

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111935 (2)

Vendor Advisories for CVE-2026-111935 (1)

Other References for CVE-2026-111935 (2)

IV. Related Vulnerabilities

Same product: NoteGen
Same vendor: codexu
Same weakness: CWE-73

V. Comments for CVE-2026-111935

No comments yet

Leave a comment