Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v | Exploit Vendor Advisory |
Configurations
History
02 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v - Exploit, Vendor Advisory |
31 Mar 2026, 18:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Streetwriters notesnook Desktop
Streetwriters |
|
| CPE | cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:* | |
| References | () https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v - Exploit, Vendor Advisory |
30 Mar 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v - |
27 Mar 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-27 22:16
Updated : 2026-04-02 14:16
NVD link : CVE-2026-33955
Mitre link : CVE-2026-33955
CVE.ORG link : CVE-2026-33955
JSON object : View
Products Affected
streetwriters
- notesnook_desktop