CVE-2026-42090 Details
Description
Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version 3.3.20, a stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app. The root cause is that exported note fields such as title, headline, and content are inserted into the generated HTML template without HTML escaping. When the note is later exported to PDF, Notesnook renders that HTML into a same-origin, unsandboxed iframe using iframe.srcdoc = .... Injected script executes in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in Notesnook Web/Desktop version 3.3.15 and Notesnook iOS/Android version 3.3.20.
A stored cross-site scripting (XSS) vulnerability has been identified in Notesnook, a privacy-focused note-taking application. This issue exists in the note export process and can be escalated to remote code execution (RCE) in the desktop version of the app. The vulnerability affects Notesnook Web/Desktop versions prior to 3.3.15 and Notesnook iOS/Android versions prior to 3.3.20. The root cause lies in the export process, where note fields such as title, headline, and content are inserted into an HTML template without proper HTML escaping. When the note is exported to PDF, the application renders the HTML in an unsandboxed iframe, allowing injected scripts to execute in the Notesnook origin. In the desktop app, this configuration enables RCE because Electron is set to allow Node.js integration without context isolation.
Users can update to Notesnook Web/Desktop version 3.3.15 or Notesnook iOS/Android version 3.3.20 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| streetwriters notesnook desktop | < 3.3.15 |
CPE
Remediation
| |
| streetwriters notesnook mobile | < 3.3.20 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |