TI-2026-26305 Aliases CVE-2026-33955

Notesnook vulnerable to RCE via stored XSS in Note History diff viewer

HIGH 72CWE-79Published 2026-03-27 · Updated 2026-04-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00351 28th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Notesnook Web/Desktop (streetwriters): 3.3.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
streetwriters	Notesnook Web/Desktop	before 3.3.11	3.3.11	Patch available	CNA

Notesnook Web/Desktop Vendorstreetwriters Affected before 3.3.11 Fixed in 3.3.11 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:streetwriters:notesnook_desktop::::::::	before 3.3.11	Vulnerable	streetwriters

cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:* Versions before 3.3.11 Vulnerable ·streetwriters

Remediation

Fix · CNA Notesnook Web/Desktop (streetwriters) Fixed in 3.3.11

Timeline

2026-10-02 Threatist record created from CVE-2026-33955

References

Exploit 1

https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v

TI-2026-26317 Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering CVSS 3.1CRITICAL 9.7
TI-2026-30458 Notesnook: RCE via stored XSS in note export rendering CVSS 3.1CRITICAL 9.6
TI-2026-24428 Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences