CVE-2026-33955
Stored XSS in Notesnook Note Viewer Enables Remote Code Execution
Publication date: 2026-03-27
Last updated on: 2026-04-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| streetwriters | notesnook_desktop | to 3.3.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Notesnook to version 3.3.11 or later, where the issue has been patched.
Avoid using vulnerable versions of the application, especially those prior to 3.3.11 on Web/Desktop.
Can you explain this vulnerability to me?
This vulnerability exists in Notesnook, a note-taking app, prior to version 3.3.11 on Web/Desktop. It is a cross-site scripting (XSS) vulnerability located in the note history comparison viewer. The issue arises because an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without proper secure handling. This vulnerability can escalate to remote code execution in the desktop application when combined with the full backup and restore feature, due to Electron being configured with `nodeIntegration: true` and `contextIsolation: false`.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to execute arbitrary code remotely on the desktop application. This means that if an attacker controls the note header content, they can exploit the XSS vulnerability to run malicious code on the victim's machine. This can lead to full compromise of the desktop application, potentially allowing access to sensitive data, unauthorized actions, or further system compromise.