CVE-2026-33976 Details
Description
Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page’s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue.
A stored cross-site scripting vulnerability has been identified in the Notesnook Web Clipper, prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS. This vulnerability can be escalated to remote code execution in the desktop application. The issue arises because the clipper retains attacker-controlled attributes from the source page's root element and embeds them into the web-clip HTML. When the clip is accessed later, Notesnook renders this HTML into a same-origin, unsandboxed iframe using 'contentDocument.write(...)'. Event-handler attributes such as 'onload', 'onclick', and 'onmouseover' execute within the Notesnook origin. In the desktop app, this configuration allows for remote code execution, as Electron is set with 'nodeIntegration: true' and 'contextIsolation: false'.
Users should update to Notesnook version 3.3.11 or later on Web/Desktop, and version 3.3.17 or later on Android/iOS.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| streetwriters notesnook desktop | < 3.3.11 |
CPE
Remediation
| |
| streetwriters notesnook mobile | < 3.3.17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |