CVE-2026-33976 - Vulnerability Analysis

Overview

Notesnook prior to 3.3.11 (Web/Desktop) and 3.3.17 (Android/iOS) contains a stored XSS caused by preservation of attacker-controlled attributes in web-clip HTML, letting attackers achieve remote code execution in the desktop app, exploit requires opening crafted clips.

Severity & Score

Impact

Attackers can execute arbitrary code remotely in the desktop app, potentially compromising the user's system.

Mitigation

Update to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS or later.

References

• https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 28, 2026

🚨 CVE-2026-33976 (CRITICAL, CVSS 9.7): Notesnook Web/Desktop <3.3.11 vulnerable to stored XSS → RCE via Web Clipper. Patch ASAP & review Electron settings. Details: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #Cybersecurity #Infosec #Vulnerability

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner