Detections
Analytics

SCA: security update for github.com/enchant97/note-mark/backend (GHSA-rqrh-8wpv-x7hh)

high Tenable Self-Hosted Container Security Plugin ID 444551

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and
 note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with
 regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because
 the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes
 validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export
 CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs
 straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create
 the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the
 configured export directory. The export process commonly runs as root (default in Docker / bare-metal
 admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been
 patched in version 0.19.5. (CVE-2026-50553)

Solution

Update the github.com/enchant97/note-mark/backend library and its related packages to version 0.0.0-20260601210719-67b7de04308a or later.

See Also

https://github.com/advisories/GHSA-rqrh-8wpv-x7hh

Plugin Details

Severity: High

ID: 444551

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/9/2026

Updated: 9/7/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.77

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-50553

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 6.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/9/2026

Vulnerability Publication Date: 7/9/2026

Reference Information

CVE: CVE-2026-50553