CVE-2026-33955: Notesnook Desktop RCE Vulnerability

CVE-2026-33955 Overview

CVE-2026-33955 is a stored Cross-Site Scripting (XSS) vulnerability in Notesnook, a popular note-taking application, that can escalate to Remote Code Execution (RCE) on desktop installations. The vulnerability exists in the note history comparison viewer, where attacker-controlled note headers are rendered using React's dangerouslySetInnerHTML without proper sanitization. When exploited on the Electron-based desktop application, the XSS payload gains full system access due to insecure Electron configuration settings.

Critical Impact
This vulnerability allows attackers to achieve remote code execution through a stored XSS attack vector, potentially compromising user systems when malicious notes are restored from backups.

Affected Products

Streetwriters Notesnook Desktop versions prior to 3.3.11
Streetwriters Notesnook Web versions prior to 3.3.11

Discovery Timeline

2026-03-27 - CVE-2026-33955 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-33955

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-controlled content within Notesnook's note history comparison feature. When a user views the history or diff of a note, the application renders note headers using React's dangerouslySetInnerHTML property. This method bypasses React's built-in XSS protections by directly inserting raw HTML into the DOM without sanitization.

Under normal circumstances, a stored XSS vulnerability would be limited to the browser context. However, Notesnook's Electron desktop application is configured with nodeIntegration: true and contextIsolation: false. These insecure settings allow JavaScript running in the renderer process to directly access Node.js APIs, effectively bridging web-based XSS to full operating system command execution.

The attack becomes particularly dangerous when combined with Notesnook's full backup and restore functionality. An attacker can craft a malicious backup file containing notes with XSS payloads embedded in their headers. When a victim imports and views this backup, the payload executes with full Node.js privileges.

Root Cause

The root cause is twofold: First, the application uses dangerouslySetInnerHTML to render user-controlled note header content without implementing proper HTML sanitization or encoding. Second, the Electron application's main process is configured with overly permissive security settings (nodeIntegration: true and contextIsolation: false), which removes the security boundary between the web content and the underlying Node.js runtime environment.

Attack Vector

The attack requires local interaction where a user must open a malicious note or restore a compromised backup. An attacker would craft a note with a malicious script payload embedded in the note header field. When the victim views the note history or comparison view, the unsanitized HTML is rendered, executing the attacker's JavaScript. In the desktop application context, this script can leverage Node.js APIs to execute arbitrary system commands, read/write files, or establish persistence.

The vulnerability mechanism involves injecting malicious HTML/JavaScript into note header fields, which are then rendered without sanitization in the history comparison viewer. When the dangerouslySetInnerHTML directive processes this content, the embedded script executes within the Electron renderer context. Due to the insecure Electron configuration, this script gains access to the full Node.js environment, enabling actions such as spawning child processes or accessing the file system. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33955

Indicators of Compromise

Presence of unexpected JavaScript or HTML tags within note content, particularly in header fields
Unusual child processes spawned from the Notesnook desktop application
Suspicious network connections originating from the Notesnook process
Modified or newly created files in system directories by the Notesnook application

Detection Strategies

Monitor for suspicious script execution patterns within Electron-based applications
Implement endpoint detection rules for unexpected Node.js API calls from Notesnook
Scan imported backup files for potentially malicious script content before restoration
Review application logs for unusual note history viewer access patterns

Monitoring Recommendations

Enable process creation monitoring to detect child processes spawned by Notesnook
Implement file integrity monitoring on critical system directories
Configure network monitoring to detect anomalous outbound connections from the application
Deploy behavioral analysis to identify JavaScript-based exploitation attempts

How to Mitigate CVE-2026-33955

Immediate Actions Required

Update Notesnook Desktop and Web applications to version 3.3.11 or later immediately
Audit any recently imported backups or notes from untrusted sources
Review system logs for signs of compromise if the vulnerable version was in use
Consider reinstalling the application from official sources after updating

Patch Information

Streetwriters has released version 3.3.11 which addresses this vulnerability by implementing proper sanitization for content rendered via dangerouslySetInnerHTML in the note history comparison viewer. Users should update to this version or later through their official distribution channels. For more details, refer to the GitHub Security Advisory.

Workarounds

Avoid importing backup files from untrusted or unknown sources until the patch is applied
Refrain from using the note history comparison feature until the application is updated
Consider using the web version with restricted browser permissions as a temporary alternative
Implement application whitelisting to prevent unauthorized child process execution from Notesnook

If immediate patching is not possible, consider restricting Notesnook's network access and disabling the backup restore functionality through organizational policies until the update can be deployed.