PT-2026-28579 · Electron+1 · Electron+1

Ngocnn97 · Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-33955

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notesnook versions prior to 3.3.11

Description Notesnook is a note-taking app with a cross-site scripting issue present in the note history comparison viewer on Web/Desktop platforms. This issue can lead to remote code execution in the desktop application. The issue occurs when an attacker-controlled note header is displayed using the dangerouslySetInnerHTML function without proper security measures. The desktop application's Electron configuration, with nodeIntegration set to true and contextIsolation set to false, allows for the escalation to remote code execution when combined with the full backup and restore feature. The vulnerable function is dangerouslySetInnerHTML. The vulnerable parameter is the note header.

Recommendations Update Notesnook to version 3.3.11 or later.

Exploit

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-33955

GHSA-45G3-CV93-Q59V

Affected Products

Electron

Notesnook

References · 7

• 🔥 https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33955.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-33955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33955 · Security Note
• https://twitter.com/CveFindCom/status/2037661775122887121 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037655216301191674 · Twitter Post
• https://twitter.com/CVEnew/status/2037719355354710281 · Twitter Post