Summary
An HTML injection vulnerability exists in Amplenote public notes that allows an attacker to inject arbitrary HTML tags (specifically <img>) into a note. This input is rendered on the public-facing note page, allowing attackers to display external images and spoof content such as fake promotions, “free gifts,” or phishing-style messages.
This can be abused to mislead users viewing public notes.
Affected URL
Example public note:
https:
Rendered public view:
https:
Vulnerability Type
Stored HTML Injection
Content Injection / UI Spoofing
Steps to Reproduce
1. Create or edit a note
Go to:
https:
2. Inject HTML image payload
Insert the following into the note content:
<img src="https://example.com/fake-gift.png">
(or any external image URL)
Example malicious usage:
<img src="https://example.com/free-gift.png">
3. Publish note
Make the note public.
4. Open public URL
Visit:
https:
Actual Result
Injected <img> tag is rendered in the public note
External image loads successfully
Attacker-controlled content is displayed inside trusted Amplenote domain
Expected Result
HTML tags should be sanitized or escaped
Only safe Markdown content should be rendered
External HTML injection should not be possible
Security Impact
This vulnerability enables:
⚠️ Content Spoofing
Attackers can inject:
Fake “Free gift” banners
Fake promotional images
Fake warnings or phishing content
⚠️ Trust Abuse
Content appears under official Amplenote domain
Users may trust malicious content due to domain legitimacy
⚠️ Social Engineering Risk
Can be used to trick users into clicking external malicious links
Severity
Medium
Recommendation
Properly sanitize all user input in notes
Escape HTML tags in public rendering layer
Restrict <img> to allow only safe, validated sources
Implement a strict Content Security Policy (CSP) for public note pages
Consider Markdown-only rendering without raw HTML support
Additional Notes
This issue is exploitable on publicly shared note pages and does not require authentication once the note is published.
Proof of Concept
Inject <img> tag in note content
Publish note
Open public URL → image renders successfully