Note Mark has Stored XSS via Unrestricted Asset Upload
Date: 2026-04
Affected: go/github.com/enchant97/note-mark/backend
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40262
CWE: CWE-434
CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

### Summary A stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without `nosniff`, browsers can sniff and render active content, giving the attacker access to authenticated Note Mark API actions as the victim. ### Details This issue results from three compounding flaws in the asset handling and delivery path. #### 1. Asset delivery can be used as an attack vector The asset delivery route can be used to deliver attacker-controlled uploaded content directly to a victim by URL. Relevant route: - `handlers/assets.go:40` ```go huma.Get(api, "/api/notes/{noteID}/assets/{assetID}", h.GetNoteAssetContentByID) ``` This makes the uploaded asset reachable by direct navigation, which provides the delivery mechanism for the payload. #### 2. Text-based active content is served with an empty `Content-Type` The asset handler relies on `h2non/filetype` for content-type detection: - `handlers/assets.go:147` ```go kind, _ := filetype.Match(buf) if kind != filetype.Unknown { contentType = kind.MIME.Value } ``` The detection library uses magic-byte matching and does not identify text-based formats such as HTML, SVG, JavaScript, XML, or XHTML. For those files, `filetype.Match` returns `Unknown`, leaving `Content-Type` unset or empty. As a result, uploaded acti


Mitigations:

Architectural layers (MAESTRO):