PT-2026-36859 · Notesnook · Notesnook

Iiihaiii · Published 2026-05-04 · Updated 2026-05-13 · CVE-2026-42090

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notesnook Web/Desktop versions prior to 3.3.15 Notesnook iOS/Android versions prior to 3.3.20

Description A stored Cross-Site Scripting (XSS) issue exists in the note export flow. The problem occurs because exported note fields, including title, headline, and content, are inserted into the generated HTML template without proper HTML escaping. When a note is exported to PDF, the application renders this HTML into a same-origin, unsandboxed iframe using iframe.srcdoc. This allows injected scripts to execute within the Notesnook origin. In the desktop application, this can be escalated to remote code execution (RCE) because Electron is configured with nodeIntegration: true and contextIsolation: false.

Recommendations Update Web/Desktop versions to 3.3.15. Update iOS/Android versions to 3.3.20.

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-42090

Affected Products

Notesnook

References · 10

• https://github.com/streetwriters/notesnook/security/advisories/GHSA-fjm8-jg78-89h4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42090 · Security Note
• https://github.com/streetwriters/notesnook/releases/tag/v3.3.15 · Note
• https://github.com/streetwriters/notesnook/releases/tag/3.3.20-android · Note
• https://twitter.com/VulmonFeeds/status/2051431813730492595 · Twitter Post
• https://twitter.com/CVEnew/status/2051361288240930984 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054381316104241216 · Twitter Post
• https://t.me/CVEtracker/52637 · Telegram Post
• https://t.me/cveNotify/163273 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051362843786612758 · Twitter Post