ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33955

Notesnook is a note-taking app.

Published Mar 27, 2026 · updated Jun 17, 2026 · streetwriters notesnook desktop

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with and . Version 3.3.11 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using without secure handling. When combined with the full backup and restore feature in the desktop appli

  2. Jun 17, 2026 · NIST NVD

    Updated

    Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using without secure handling. When combined with the full backup and restore feature in the desktop appli

Affected

  • cpe streetwriters/notesnook desktopversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33955

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33955

    Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header

    nvd.nist.gov

References