Codexu vulnerabilities
We track 2 vulnerabilities in Codexu products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 26, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Codexu vulnerabilities
- 8.3 High severity
NoteGen: Improper Neutralization of Special Elements used in an OS Command
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execu
- 8.1 High severity
NoteGen: Improper Neutralization of Input During Web Page Generation
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that rea