Read the docs
TI-2026-26319 Aliases CVE-2026-33978

Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobile share editor WebView. An attacker can control the shared title metadata (for example through Android/iOS share metadata such as TITLE / SUBJECT, or through link-preview title data) and inject HTML such as </a><img src=x onerror=...>. When the victim opens the Notesnook share flow and selects Web clip, the payload is inserted into the generated HTML and executed in the mobile editor WebView. This issue has been patched in version 3.3.17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed notesnook (streetwriters): 3.3.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
streetwritersnotesnookbefore 3.3.173.3.17Patch availableCNA
  • notesnook Vendorstreetwriters Affected before 3.3.17 Fixed in 3.3.17 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*before 3.3.17Vulnerablestreetwriters
cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*before 3.3.17Vulnerablestreetwriters
  • cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:* Versions before 3.3.17 Vulnerable ·streetwriters
  • cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:* Versions before 3.3.17 Vulnerable ·streetwriters

Remediation

  • Fix · CNA notesnook (streetwriters) Fixed in 3.3.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33978

References

Exploit 1

Patch 1

Other 1

  • TI-2026-26317 Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering CVSS 3.1CRITICAL 9.7
  • TI-2026-30458 Notesnook: RCE via stored XSS in note export rendering CVSS 3.1CRITICAL 9.6
  • TI-2026-24428 Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences