CVE-2026-33976
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
27/03/2026
Última modificación:
31/03/2026
Descripción
*** Pendiente de traducción *** Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page’s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue.
Impacto
Puntuación base 3.x
9.60
Gravedad 3.x
CRÍTICA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:* | 3.3.11 (excluyendo) | |
| cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:* | 3.3.17 (excluyendo) | |
| cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:* | 3.3.17 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página