What is the CVSS score of CVE-2026-33976?

CVE-2026-33976 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Notesnook Web Desktop are affected by CVE-2026-33976?

Notewnook Web Clipper versions prior to 3.3.11 (Web/Desktop) and 3.3.17 (Android/iOS) contain a stored cross-site scripting vulnerability that enables remote code execution when users open malicious…. A patch is available.

How to fix or mitigate CVE-2026-33976?

Within 24 hours: Identify all Notesnook Web Clipper installations across the organization (web, desktop, Android, iOS) and document current versions. Within 7 days: Deploy Notesnook Web Clipper version 3.3.11 or later (Web/Desktop) and 3.3.17 or later (Android/iOS) via MDM, package managers, or browser extension update mechanisms; verify deployment completion across 95%+ of user base. Within 30 days: Conduct post-deployment audit to confirm 100% compliance and review access logs for any suspicious clipper activity or JavaScript execution anomalies during the pre-patch window.

Notesnook Web Desktop CVE-2026-33976

EUVD-2026-16874 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 GitHub_M

XSS RCE Google Apple Notesnook Web Desktop Notesnook Ios Android Streetwriters

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.3.17,3.3.11

EUVD ID Assigned

Mar 27, 2026 - 22:00 euvd

EUVD-2026-16874

Analysis Generated

Mar 27, 2026 - 22:00 vuln.today

CVE Published

Mar 27, 2026 - 21:26 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page’s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using contentDocument.write(...). Event-handler attributes such as onload, onclick, or onmouseover execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with nodeIntegration: true and contextIsolation: false. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue.

AnalysisAI

Remote code execution via stored XSS in Notesnook Web Clipper affects all platforms prior to version 3.3.11 (Web/Desktop) and 3.3.17 (Android/iOS). Attackers can inject malicious HTML attributes into clipped web content that execute JavaScript in the application's security context when victims open the clip. On Electron desktop builds, unsafe Node.js integration (nodeIntegration: true, contextIsolation: false) escalates this XSS to full RCE with system-level access. CVSS 9.6 (Critical) reflects network-based attack requiring no authentication but user interaction. No public exploit identified at time of analysis, though attack methodology is detailed in vendor advisory.

Technical ContextAI

Notesnook's Web Clipper feature saves external webpage content as HTML notes. The vulnerability (CWE-79: Cross-site Scripting) exists in the clipper's sanitization logic, which preserves attacker-controlled attributes from the source page's root HTML element without proper filtering. When rendering saved clips, the application uses contentDocument.write() to inject this HTML into an unsandboxed, same-origin iframe. Event-handler attributes like onload, onclick, and onmouseover survive sanitization and execute in Notesnook's origin context. The Electron desktop application (cpe:2.3:a:streetwriters:notesnook_web/desktop) compounds this by configuring the renderer process with nodeIntegration enabled and contextIsolation disabled-deprecated unsafe settings that grant JavaScript full Node.js API access. This allows the stored XSS payload to invoke require('child_process') or similar modules for arbitrary code execution. Mobile platforms (cpe:2.3:a:streetwriters:notesnook_ios/android) are limited to XSS impact within WebView constraints, though still pose data theft risks.

RemediationAI

Vendor-released patch: Upgrade immediately to Notesnook version 3.3.11 for Web/Desktop platforms or version 3.3.17 for Android/iOS mobile applications. Updates are available through standard distribution channels including the official website for desktop builds, Google Play Store for Android, and Apple App Store for iOS. The patch implements proper HTML attribute sanitization in the Web Clipper rendering pipeline, stripping event-handler attributes before storage and display. Desktop Electron builds should also migrate toward contextIsolation: true and nodeIntegration: false configurations in future releases to implement defense-in-depth against similar vulnerabilities. No effective workarounds exist; disabling the Web Clipper feature entirely would prevent new malicious clips but would not remediate existing stored payloads. Organizations should audit existing notes created via Web Clipper for suspicious content, particularly clips sourced from untrusted or unknown websites. Full security advisory and technical details at https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5.