CVE-2026-33955

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Notesnook es una aplicación para tomar notas. Antes de la versión 3.3.11 en Web/Escritorio, una vulnerabilidad de cross-site scripting almacenada en el visor de comparación del historial de notas puede escalar a ejecución remota de código en una aplicación de escritorio. El problema se activa cuando un encabezado de nota controlado por el atacante se muestra usando “dangerouslySetInnerHTML” sin un manejo seguro. Cuando se combina con la función completa de copia de seguridad y restauración en la aplicación de escritorio, esto se convierte en ejecución remota de código porque Electron está configurado con “nodeIntegration: true” y “contextIsolation: false”. La versión 3.3.11 corrige el problema.

Information

Published : 2026-03-27 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-33955

Mitre link : CVE-2026-33955

CVE.ORG link : CVE-2026-33955

JSON object : View

Products Affected

streetwriters

notesnook_desktop

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-33955", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33955", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T03:55:21.973411Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "streetwriters", "product": "Notesnook Web/Desktop", "versions": [{"status": "affected", "version": "< 3.3.11"}]}]}], "published": "2026-03-27T22:16:22.083", "references": [{"url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue."}, {"lang": "es", "value": "Notesnook es una aplicaci\u00f3n para tomar notas. Antes de la versi\u00f3n 3.3.11 en Web/Escritorio, una vulnerabilidad de cross-site scripting almacenada en el visor de comparaci\u00f3n del historial de notas puede escalar a ejecuci\u00f3n remota de c\u00f3digo en una aplicaci\u00f3n de escritorio. El problema se activa cuando un encabezado de nota controlado por el atacante se muestra usando \u201cdangerouslySetInnerHTML\u201d sin un manejo seguro. Cuando se combina con la funci\u00f3n completa de copia de seguridad y restauraci\u00f3n en la aplicaci\u00f3n de escritorio, esto se convierte en ejecuci\u00f3n remota de c\u00f3digo porque Electron est\u00e1 configurado con \u201cnodeIntegration: true\u201d y \u201ccontextIsolation: false\u201d. La versi\u00f3n 3.3.11 corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08C11EDB-67C1-4E85-A07D-0164CB036757", "versionEndExcluding": "3.3.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}