Low severity2.6NVD Advisory· Published Oct 19, 2026
CVE-2026-111935
CVE-2026-111935
Description
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/chat-image-context.tsnvd
- github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/sync/conversation-sync.tsnvd
- github.com/codexu/note-gen/commit/64e671eb58f56ad6ebec0d99d32f6037f9319979nvd
- github.com/codexu/note-gen/commit/6840c13c4fcb71a79b7df838d19a026830d64b96nvd
- github.com/codexu/note-gen/issues/1296nvd
- www.vulncheck.com/advisories/notegen-through-0.38.3-local-file-disclosure-via-chat-image-analysisnvd
News mentions
0No linked articles in our index yet.