CVE-2026-33955
Published: 27 March 2026
Summary
CVE-2026-33955 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Streetwriters Notesnook Desktop. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-33955 is a stored cross-site scripting (XSS) vulnerability, associated with CWE-79 and CWE-94, affecting Notesnook, an open-source note-taking application. The flaw impacts the Web and Desktop versions prior to 3.3.11, specifically in the note history comparison viewer. There, an attacker-controlled note header is rendered using React's `dangerouslySetInnerHTML` without secure sanitization, enabling XSS payload execution.
Exploitation requires a user to view a note history comparison containing a malicious note header crafted by the attacker, which triggers the XSS (CVSS v3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). In the Electron-based Desktop application, configured with `nodeIntegration: true` and `contextIsolation: false`, attackers can chain this with the full backup and restore feature to achieve remote code execution, granting high-impact confidentiality, integrity, and availability compromise following user interaction.
The official GitHub Security Advisory (GHSA-45g3-cv93-q59v) documents the issue, confirming that Notesnook version 3.3.11 patches the vulnerability by addressing the insecure rendering in the note history comparison viewer. Security practitioners should urge users to update to 3.3.11 or later and avoid restoring untrusted backups.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16872
Vulnerability details
Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note…
more
header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in Electron desktop app (nodeIntegration enabled) directly enables client-side exploitation for code execution (T1203) when user views malicious note history comparison (T1204), chaining to RCE via backup/restore.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires filtering and sanitization of information prior to display, directly preventing stored XSS from unsafe rendering of attacker-controlled note headers via dangerouslySetInnerHTML.
Mandates validation of user inputs like note headers to block malicious XSS payloads from being stored in note history.
Enforces secure baseline configurations in Electron desktop apps, such as nodeIntegration: false and contextIsolation: true, to block XSS escalation to remote code execution during backup/restore.