CVE-2026-33955

Received Received - Intake

Stored XSS in Notesnook Note Viewer Enables Remote Code Execution

Publication date: 2026-03-27

Last updated on: 2026-04-02

Assigner: GitHub, Inc.

Description

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-27

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2026-03-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33955

Affected Vendors & Products

Vendor	Product	Version / Range
streetwriters	notesnook_desktop	to 3.3.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Notesnook, a note-taking app, prior to version 3.3.11 on Web/Desktop. It is a cross-site scripting (XSS) vulnerability located in the note history comparison viewer. The issue arises because an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without proper secure handling. This vulnerability can escalate to remote code execution in the desktop application when combined with the full backup and restore feature, due to Electron being configured with `nodeIntegration: true` and `contextIsolation: false`.

Impact Analysis

The vulnerability can allow an attacker to execute arbitrary code remotely on the desktop application. This means that if an attacker controls the note header content, they can exploit the XSS vulnerability to run malicious code on the victim's machine. This can lead to full compromise of the desktop application, potentially allowing access to sensitive data, unauthorized actions, or further system compromise.

Mitigation Strategies

To mitigate this vulnerability, you should update Notesnook to version 3.3.11 or later, where the issue has been patched.

Avoid using vulnerable versions of the application, especially those prior to 3.3.11 on Web/Desktop.

Hi! I’m here to help you understand CVE-2026-33955. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70