CVE-2026-40262 - Vulnerability Analysis

Overview

Mark is an open-source note-taking application <= 0.19.1 contains a stored XSS caused by improper content type handling in asset delivery, letting authenticated users execute scripts in victim's browser, exploit requires user authentication.

Severity & Score

Impact

Authenticated attackers can execute JavaScript in victim's browser, stealing session data and performing actions on their behalf.

Mitigation

Update to version 0.19.2 or later.

References

• https://github.com/enchant97/note-mark/commit/6bb62842ccb956870b9bf183629eba95e326e5e3
• https://github.com/enchant97/note-mark/releases/tag/v0.19.2
• https://github.com/enchant97/note-mark/security/advisories/GHSA-9pr4-rf97-79qh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner