CVE-2026-33978

{"id": "CVE-2026-33978", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33978", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T19:07:14.241983Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "streetwriters", "product": "notesnook", "versions": [{"status": "affected", "version": "< 3.3.17"}]}]}], "published": "2026-04-01T17:28:39.660", "references": [{"url": "https://github.com/streetwriters/notesnook/commit/fc8807f74db5539036c5e58d3d68a11ea54098db", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/streetwriters/notesnook/releases/tag/3.3.17-android", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f27j-fqc6-v7pm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobile share editor WebView. An attacker can control the shared title metadata (for example through Android/iOS share metadata such as TITLE / SUBJECT, or through link-preview title data) and inject HTML such as </a><img src=x onerror=...>. When the victim opens the Notesnook share flow and selects Web clip, the payload is inserted into the generated HTML and executed in the mobile editor WebView. This issue has been patched in version 3.3.17."}, {"lang": "es", "value": "Notesnook es una aplicaci\u00f3n para tomar notas centrada en la privacidad del usuario y la facilidad de uso. Antes de la versi\u00f3n 3.3.17, existe una vulnerabilidad XSS almacenada en el flujo de compartir m\u00f3vil / clip web porque los metadatos del clip controlados por el atacante se concatenan en HTML sin escapar y luego se renderizan con innerHTML dentro del WebView del editor de compartir m\u00f3vil. Un atacante puede controlar los metadatos del t\u00edtulo compartido (por ejemplo, a trav\u00e9s de metadatos de compartir de Android/iOS como TITLE / SUBJECT, o a trav\u00e9s de datos de t\u00edtulo de vista previa de enlace) e inyectar HTML como </a [tag_HTML_PoC] . Cuando la v\u00edctima abre el flujo de compartir de Notesnook y selecciona Clip web, la carga \u00fatil se inserta en el HTML generado y se ejecuta en el WebView del editor m\u00f3vil. Este problema ha sido parcheado en la versi\u00f3n 3.3.17."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "105C802D-D317-4B9A-B883-D07A1E0840E6", "versionEndExcluding": "3.3.17"}, {"criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "858B01C2-38C3-4093-A638-E380119ABDF5", "versionEndExcluding": "3.3.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}