PT-2026-29568 · Notesnook · Notesnook

Ngocnn97 · CVE-2026-33978 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Notesnook versions prior to 3.3.17

Description A stored Cross-Site Scripting (XSS) issue exists in the mobile share and web clip flow. The problem occurs because metadata from a shared clip is concatenated into HTML without proper escaping and subsequently rendered using innerHTML within the mobile share editor WebView. An attacker can manipulate shared title metadata, such as Android/iOS share metadata (TITLE or SUBJECT) or link-preview title data, to inject malicious HTML. When a user opens the share flow and selects a Web clip, the injected payload is executed within the mobile editor WebView.

Recommendations Update to version 3.3.17.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33978

GHSA-F27J-FQC6-V7PM

Affected Products

Notesnook

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33978.json · Exploit
• https://github.com/streetwriters/notesnook/security/advisories/GHSA-f27j-fqc6-v7pm · Vendor Advisory
• https://github.com/streetwriters/notesnook/commit/fc8807f74db5539036c5e58d3d68a11ea54098db · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33978 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33978 · Vendor Advisory
• https://github.com/streetwriters/notesnook/releases/tag/3.3.17-android · Note