PT-2026-36859 · Notesnook · Notesnook

Iiihaiii · CVE-2026-42090 · Published 2026-05-04 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notesnook Web/Desktop versions prior to 3.3.15 Notesnook iOS/Android versions prior to 3.3.20

Description A stored Cross-Site Scripting (XSS) issue exists in the note export flow. The problem occurs because exported note fields, including title, headline, and content, are inserted into the generated HTML template without proper HTML escaping. When a note is exported to PDF, the application renders this HTML into a same-origin, unsandboxed iframe using iframe.srcdoc. This allows injected scripts to execute within the Notesnook origin. In the desktop application, this can be escalated to remote code execution (RCE) because Electron is configured with nodeIntegration: true and contextIsolation: false.

Recommendations Update Web/Desktop versions to 3.3.15. Update iOS/Android versions to 3.3.20.

Exploit

Fix

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-42090

GHSA-FJM8-JG78-89H4

Affected Products

Notesnook

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42090.json · Exploit
• https://github.com/streetwriters/notesnook/security/advisories/GHSA-fjm8-jg78-89h4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42090 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42090 · Vendor Advisory
• https://github.com/streetwriters/notesnook/releases/tag/v3.3.15 · Note
• https://github.com/streetwriters/notesnook/releases/tag/3.3.20-android · Note
• https://twitter.com/lyrie_ai/status/2054381316104241216 · Twitter Post
• https://t.me/cveNotify/163273 · Telegram Post
• https://t.me/CVEtracker/52637 · Telegram Post
• https://twitter.com/CVEnew/status/2051361288240930984 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051431813730492595 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051362843786612758 · Twitter Post