Note Mark versions 0.19.1 and prior are susceptible to stored cross-site scripting, allowing an authenticated attacker to execute malicious scripts within the context of other users' sessions.

The application incorrectly handles file uploads by relying on magic-byte detection, which fails to identify text-based formats like HTML or SVG. An authenticated attacker can upload malicious files that the browser renders as active content, leading to cross-site scripting under the application origin.

This vulnerability allows an attacker to compromise user sessions, potentially leading to unauthorized data access, account takeover, or the execution of unauthorized API actions. Given the CVSS score of 8.7, this represents a high-severity risk to the integrity and confidentiality of the platform, as it allows for the escalation of privileges through hijacked session tokens.

Immediate Action: Update the Note Mark backend to version 0.19.2 or the specific commit provided in the vendor security advisory to implement proper content-type validation and security headers.

Proactive Monitoring: Review web server access logs for anomalous file upload activity or requests involving SVG and HTML files originating from non-administrative users.

Compensating Controls: Deploy a Web Application Firewall to block the upload of executable file types and enforce strict Content-Security-Policy headers to prevent the execution of unauthorized inline scripts.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is significant due to the potential for session hijacking and unauthorized API access. Administrators should prioritize updating to version 0.19.2 immediately to neutralize the threat. Failure to patch leaves the application and its users vulnerable to persistent cross-site scripting attacks that bypass standard security controls.