Unanchored Regex Vulnerability in Note Mark Open-Source Application

CVE-2026-50553

What is CVE-2026-50553?

A vulnerability in the Note Mark open-source note-taking application prior to version 0.19.5 allows attackers to exploit unanchored regex validation of book and note slug values. This flaw permits malicious slugs to be accepted and stored without proper sanitization, leading to arbitrary directory creation and file writing outside the designated export directory. When executed under elevated privileges, this vulnerability could have significant security ramifications, making it essential for users to upgrade to version 0.19.5 to mitigate this risk.

References