PT-2026-28580 · Electron+1 · Electron+1

Ngocnn97

·

Published

2026-03-27

·

Updated

2026-04-05

·

CVE-2026-33976

CVSS v3.1

9.6

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Notesnook versions prior to 3.3.11 (Web/Desktop) and prior to 3.3.17 (Android/iOS)
Description Notesnook is a note-taking app. A stored cross-site scripting (XSS) issue in the Web Clipper rendering flow can be exploited to achieve remote code execution (RCE) in the desktop application. The root cause is the preservation of attacker-controlled attributes from the source page’s root element within web-clip HTML. When these clips are opened, Notesnook renders the HTML into a same-origin, unsandboxed iframe using contentDocument.write(...). Event-handler attributes like onload, onclick, or onmouseover are then executed within the Notesnook origin. In the desktop app, this leads to RCE because Electron is configured with nodeIntegration: true and contextIsolation: false.
Recommendations Update to version 3.3.11 for Web/Desktop. Update to version 3.3.17 for Android/iOS.

Exploit

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94CWE-79

Related Identifiers

CVE-2026-33976
GHSA-F42F-PHVP-43X5

Affected Products

Electron
Notesnook