CVE-2026-33955
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
42/100
Published: 2026-03-27
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
High
I:
High
A:
High
Description
Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| streetwriters | notesnook_desktop | < 3.3.11 |
References & Advisories (1)
Exploit
Vendor Advisory