CVE-2026-33976
Published: 27 March 2026
Description
Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that…
more
the clipper preserves attacker-controlled attributes from the source page’s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue.
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes web clipper inputs to prevent storage of attacker-controlled event-handler attributes that enable stored XSS.
Filters HTML output when rendering stored web clips in iframes to block execution of malicious JavaScript from preserved attributes.
Enforces secure Electron configuration settings like nodeIntegration: false and contextIsolation: true to prevent XSS payloads from escalating to RCE.
Security SummaryAI
CVE-2026-33976 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79 and CWE-94, in the Web Clipper rendering flow of Notesnook, an open-source note-taking application. It affects Web and Desktop versions prior to 3.3.11 and Android/iOS versions prior to 3.3.17. The issue stems from the Web Clipper preserving attacker-controlled attributes, such as event handlers like onload, onclick, or onmouseover, from the root element of a clipped webpage and storing them in the web-clip HTML. When the clip is later viewed, Notesnook renders this HTML inside a same-origin, unsandboxed iframe via contentDocument.write(), allowing the malicious attributes to execute JavaScript in the Notesnook origin. The vulnerability carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
An attacker can exploit this by controlling a malicious webpage that a victim clips using Notesnook's Web Clipper feature. No authentication or privileges are required (PR:N), but user interaction is needed for the victim to clip the page and subsequently open the stored clip (UI:R). In the Web or mobile apps, this results in arbitrary JavaScript execution within the Notesnook context. On the Electron-based Desktop app, where nodeIntegration is enabled and contextIsolation is disabled, the XSS escalates to full remote code execution (RCE), granting the attacker high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) on the victim's local system.
The official patch is available in Notesnook version 3.3.11 for Web and Desktop, and 3.3.17 for Android and iOS, which addresses the improper handling of preserved attributes in web clips. Additional details, including the full advisory and patch information, are provided in the GitHub Security Advisory at https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5. Security practitioners should urge users to update immediately and avoid clipping untrusted webpages.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in Notesnook Web Clipper enables exploitation of client application vulnerability for arbitrary JavaScript execution and RCE on Electron desktop app.