CVE-2026-40262

A stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without nosniff, browsers can sniff and render active content, giving the attacker access to authenticated Note Mark API actions as the victim.

Details

This issue results from three compounding flaws in the asset handling and delivery path.

1. Asset delivery can be used as an attack vector

The asset delivery route can be used to deliver attacker-controlled uploaded content directly to a victim by URL.

Relevant route:

• handlers/assets.go:40

huma.Get(api, "/api/notes/{noteID}/assets/{assetID}", h.GetNoteAssetContentByID)

This makes the uploaded asset reachable by direct navigation, which provides the delivery mechanism for the payload.

2. Text-based active content is served with an empty Content-Type

The asset handler relies on h2non/filetype for content-type detection:

• handlers/assets.go:147

kind, _ := filetype.Match(buf)
if kind != filetype.Unknown {
    contentType = kind.MIME.Value
}

The detection library uses magic-byte matching and does not identify text-based formats such as HTML, SVG, JavaScript, XML, or XHTML. For those files, filetype.Match returns Unknown, leaving Content-Type unset or empty.

As a result, uploaded active content is served without an authoritative MIME type.

3. Files are rendered inline and sniffed by the browser

The asset response is sent with inline disposition:

• handlers/assets.go:153

w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s\"", asset.Name))

At the same time, the response does not set:

X-Content-Type-Options: nosniff

This combination is dangerous:

• the uploaded file contains attacker-controlled active markup
• the browser is instructed to render it inline
• the response does not provide a trustworthy content type
• content sniffing is not disabled

Under these conditions, browsers may detect HTML or SVG content and execute embedded JavaScript. Because the asset is served from the application’s own origin, the script runs with same-origin access to the application and its authenticated APIs.

This turns an uploaded asset into a stored XSS payload that executes when a victim opens the asset URL.

PoC

The issue can be reproduced by uploading a text-based active content file such as HTML or SVG as a note asset, then opening the served asset URL in a browser and observing that script executes in the context of the application origin.

• Type: Stored same-origin cross-site scripting (XSS)
• Who is impacted: Any user who can be induced to open a malicious asset URL, and any deployment allowing asset uploads
• Security impact: An attacker can execute JavaScript in the victim’s authenticated application context, allowing access to private notes, books, profile data, and authenticated API actions
• Privileges required: A valid low-privilege user account capable of uploading note assets
• User interaction: Required, because the victim must navigate to the malicious asset URL
• Scope: Changed, because attacker-controlled content executes in the victim’s origin and impacts other users rather than remaining confined to the attacker’s own account

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-40262 has a CVSS score of 8.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20260411145018-6bb62842ccb9); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-40262? CVE-2026-40262 is a high-severity cross-site scripting (XSS) vulnerability in github.com/enchant97/note-mark/backend (go), affecting versions < 0.0.0-20260411145018-6bb62842ccb9. It is fixed in 0.0.0-20260411145018-6bb62842ccb9. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-40262? CVE-2026-40262 has a CVSS score of 8.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/enchant97/note-mark/backend are affected by CVE-2026-40262? github.com/enchant97/note-mark/backend (go) versions < 0.0.0-20260411145018-6bb62842ccb9 is affected.
4. Is there a fix for CVE-2026-40262? Yes. CVE-2026-40262 is fixed in 0.0.0-20260411145018-6bb62842ccb9. Upgrade to this version or later.
5. Is CVE-2026-40262 exploitable, and should I be worried? Whether CVE-2026-40262 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-40262 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-40262? Upgrade github.com/enchant97/note-mark/backend to 0.0.0-20260411145018-6bb62842ccb9 or later.