NoteGen EUVD-2026-104316

Exploitation requires that the attacker already has write access to the victim's configured sync target so they can inject or modify synced conversation data, and the victim must use NoteGen's chat image analysis feature so that image_inspect processes the attacker-controlled attachment. The malicious sourceUrl must be an absolute filesystem path or a file:// URL (pre-patch the value was passed through new URL() and read directly, or read with BaseDirectory.AppData only when relative). Limiting factors: the attacker needs write access to the sync backend (PR:L / authenticated-equivalent), a specific crafted path must survive the sync-merge flow (AT:P, AC:H), the leak only triggers when the victim's client syncs and runs image analysis (UI:P passive interaction), and impact is confined to disclosing local image file contents to the AI provider - no integrity, availability, or non-image file read. The patch rejects anything that is not a relative path confined to the conversation-assets directory.

All signals converge on LOW real-world priority. The vendor CVSS 4.0 base score is 2.1, driven by a demanding chain: AV:N but AC:H (high complexity), AT:P (a specific attack requirement must be met), PR:L (the attacker already needs write access to the victim's sync target), UI:P (passive victim interaction), and only VC:L confidentiality impact with no integrity or availability impact. There is no EPSS score provided, no CISA KEV listing, and no public exploit code referenced - exploitation status is 'no public exploit identified at time of analysis'. The impact is also bounded: image_inspect leaks the contents of local image files to the configured AI/OCR provider, not arbitrary text files or credentials, so this is an image-only information-disclosure primitive rather than full arbitrary local file read. The single most limiting factor is the precondition that the attacker must already control or have write access to the victim's sync remote, making this a targeted, post-compromise-of-sync scenario rather than a broadly exploitable flaw. No signals conflict: low score, no KEV, no POC, a niche product, and a constrained impact all agree this is a real but low-priority issue to patch during normal maintenance.

An attacker who already has write access to the victim's configured NoteGen sync target (e.g. a shared or compromised sync backend) injects a conversation record whose image attachment sourceUrl is an absolute path or a file:// URL pointing at a local image on the victim's machine. When the victim's NoteGen client syncs and the chat image analysis feature (image_inspect) processes the attachment, it reads that local file and transmits its bytes to the AI/OCR provider, disclosing the image. No public exploit code is referenced, though the source-level root cause is confirmed in the patched chat-image-context.ts.