[+] NoteGen chat-preview XSS reproduction started at 2026-07-26T19:37:39Z
[+] ROOT=/workspace/bundle
[+] Using repository path: /pruva/project-cache/repo
[+] Fixed commit: ae3ba948c41d8a74b4a20f4c6f26fcdda2002298
[+] Vulnerable parent commit: 70dfd0042f56f24dc29df710f6dd2e009731e6a4
[+] Source hunk check passed: vulnerable uses markdown-it html:true + dangerouslySetInnerHTML; fixed uses StreamdownRenderer
[+] pnpm: 10.18.0
[+] Browser: /tmp/pruva-notegen-chat-preview-xss/puppeteer-cache/chrome/linux-142.0.7444.162/chrome-linux64/chrome
Preparing worktree (detached HEAD 70dfd004)
Preparing worktree (detached HEAD ae3ba948)
[+] Installing NoteGen frontend dependencies for vulnerable
[+] Installing NoteGen frontend dependencies for fixed
[+] Starting NoteGen Next UI for vulnerable on port 3456
[+] Starting NoteGen Next UI for fixed on port 3456
{
  "schema_version": 1,
  "claim": "NoteGen before 0.32.0 chat-preview renders AI chat responses with markdown-it html:true and dangerouslySetInnerHTML, allowing executable HTML induced by attacker-controlled Skill REFERENCE.md content",
  "fixed_commit": "ae3ba948c41d8a74b4a20f4c6f26fcdda2002298",
  "vulnerable_commit": "70dfd0042f56f24dc29df710f6dd2e009731e6a4",
  "observations": [
    {
      "schema_version": 1,
      "marker": "NOTEGEN_CVE_2026_17496_vulnerable_1_1785094699018674898",
      "prompt_reached_model_path": true,
      "model_output_recorded": true,
      "chat_preview_dom_reached": true,
      "browser_window_marker_observed": true,
      "document_xss_attr_observed": true,
      "xss_node_observed": true,
      "xss_observed": true,
      "raw_img_count": 0,
      "raw_svg_count": 0,
      "raw_iframe_count": 1,
      "raw_onerror_count": 0,
      "raw_onload_count": 0,
      "raw_srcdoc_count": 1,
      "escaped_img_count": 0,
      "escaped_svg_count": 0,
      "escaped_iframe_count": 0,
      "content_security_policy_header_present": false,
      "expected_xss": true
    },
    {
      "schema_version": 1,
      "marker": "NOTEGEN_CVE_2026_17496_vulnerable_2_1785094729856451212",
      "prompt_reached_model_path": true,
      "model_output_recorded": true,
      "chat_preview_dom_reached": true,
      "browser_window_marker_observed": true,
      "document_xss_attr_observed": true,
      "xss_node_observed": true,
      "xss_observed": true,
      "raw_img_count": 0,
      "raw_svg_count": 0,
      "raw_iframe_count": 1,
      "raw_onerror_count": 0,
      "raw_onload_count": 0,
      "raw_srcdoc_count": 1,
      "escaped_img_count": 0,
      "escaped_svg_count": 0,
      "escaped_iframe_count": 0,
      "content_security_policy_header_present": false,
      "expected_xss": true
    },
    {
      "schema_version": 1,
      "marker": "NOTEGEN_CVE_2026_17496_fixed_1_1785094771148764097",
      "prompt_reached_model_path": true,
      "model_output_recorded": true,
      "chat_preview_dom_reached": true,
      "browser_window_marker_observed": false,
      "document_xss_attr_observed": false,
      "xss_node_observed": false,
      "xss_observed": false,
      "raw_img_count": 0,
      "raw_svg_count": 0,
      "raw_iframe_count": 0,
      "raw_onerror_count": 0,
      "raw_onload_count": 0,
      "raw_srcdoc_count": 0,
      "escaped_img_count": 0,
      "escaped_svg_count": 0,
      "escaped_iframe_count": 0,
      "content_security_policy_header_present": false,
      "expected_xss": false
    },
    {
      "schema_version": 1,
      "marker": "NOTEGEN_CVE_2026_17496_fixed_2_1785094800727707881",
      "prompt_reached_model_path": true,
      "model_output_recorded": true,
      "chat_preview_dom_reached": true,
      "browser_window_marker_observed": false,
      "document_xss_attr_observed": false,
      "xss_node_observed": false,
      "xss_observed": false,
      "raw_img_count": 0,
      "raw_svg_count": 0,
      "raw_iframe_count": 0,
      "raw_onerror_count": 0,
      "raw_onload_count": 0,
      "raw_srcdoc_count": 0,
      "escaped_img_count": 0,
      "escaped_svg_count": 0,
      "escaped_iframe_count": 0,
      "content_security_policy_header_present": false,
      "expected_xss": false
    }
  ],
  "vulnerable_xss_count": 2,
  "fixed_xss_count": 0,
  "observed_impact": "xss",
  "primary_oracle": "Puppeteer Chromium executed an iframe srcdoc script inserted by the vulnerable real ChatPreview DOM path; fixed v0.32.0 reached the same prompt/model/chat-preview path without executing the script"
}
[+] CONFIRMED: vulnerable NoteGen chat-preview fired XSS markers; fixed commit did not.