CVE-2026-33955

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue.

Affected products

Electron, Notesnook

Streetwriters Notesnook Desktop

< 3.3.11

Fix

Available

CVSS 3.1

8.6 HIGH

EPSS

0.3% (27th percentile)

Weakness

CWE-79, CWE-94

NVD status

Modified

Published

2026-03-27

No exploit for CVE-2026-33955 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.