CVE-2026-40262 Details

A stored cross-site scripting vulnerability has been identified in Note Mark, an open-source note-taking application, in versions through 0.19.1. The issue arises because the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type. This method fails to recognize text-based formats such as HTML, SVG, or XHTML, resulting in these files being delivered with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition. Consequently, browsers can sniff and execute active content. An authenticated user can exploit this by uploading an HTML or SVG file containing JavaScript as a note asset. When a victim accesses the asset URL, the script executes under the application's origin, with access to the victim's authenticated session and API actions.

Users can update to Note Mark version 0.19.2, which addresses this vulnerability by implementing proper content type handling and removing the liquid parser from the render.