CVE-2026-111935
2.6 LOWpublic exploit availablePublished 2026-10-19 · Updated 2026-10-19
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-73
Public exploit & PoC references
- https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/chat-image-context.ts
- https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/sync/conversation-sync.ts
- https://github.com/codexu/note-gen/commit/64e671eb58f56ad6ebec0d99d32f6037f9319979
- https://github.com/codexu/note-gen/commit/6840c13c4fcb71a79b7df838d19a026830d64b96
- https://github.com/codexu/note-gen/issues/1296
All references
- https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/chat-image-context.ts
- https://github.com/codexu/note-gen/blob/note-gen-v0.38.3/src/lib/sync/conversation-sync.ts
- https://github.com/codexu/note-gen/commit/64e671eb58f56ad6ebec0d99d32f6037f9319979
- https://github.com/codexu/note-gen/commit/6840c13c4fcb71a79b7df838d19a026830d64b96
- https://github.com/codexu/note-gen/issues/1296
- https://www.vulncheck.com/advisories/notegen-through-0.38.3-local-file-disclosure-via-chat-image-analysis
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100637PoC
- HIGHCVE-2026-100638PoC
- UNSCOREDCVE-2026-101126
- CRITICALCVE-2026-101148
- MEDIUMCVE-2026-102141PoC
- MEDIUMCVE-2026-102146PoC
- CRITICALCVE-2026-103255PoC
- HIGHCVE-2026-103398PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.