CVE-2026-33976: Notesnook Desktop RCE Vulnerability

CVE-2026-33976 Overview

CVE-2026-33976 is a critical stored Cross-Site Scripting (XSS) vulnerability in Notesnook, a popular open-source note-taking application. The vulnerability exists in the Web Clipper rendering flow and can be escalated to remote code execution (RCE) in the desktop application. When users clip web pages using the Notesnook Web Clipper, attacker-controlled attributes from the source page's root element are preserved and stored within the web-clip HTML. When this clip is subsequently opened, the application renders the malicious HTML into a same-origin, unsandboxed iframe using contentDocument.write(...), allowing arbitrary JavaScript execution in the Notesnook origin context.

Critical Impact

This vulnerability allows attackers to achieve remote code execution on desktop systems through crafted web pages that exploit the Web Clipper functionality, leveraging Electron's misconfigured security settings.

Affected Products

• Streetwriters Notesnook Desktop (versions prior to 3.3.11)
• Streetwriters Notesnook Mobile for Android (versions prior to 3.3.17)
• Streetwriters Notesnook Mobile for iOS (versions prior to 3.3.17)

Discovery Timeline

• 2026-03-27 - CVE-2026-33976 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33976

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of HTML content captured by the Notesnook Web Clipper. When a user clips a web page, the clipper preserves attributes from the source page's root element, including potentially malicious event-handler attributes such as onload, onclick, or onmouseover. These attributes are stored within the web-clip HTML without proper sanitization.

The critical issue arises during the rendering phase when a user opens a saved clip. Notesnook renders the stored HTML into a same-origin, unsandboxed iframe using the contentDocument.write(...) method. This allows any embedded event-handler attributes to execute JavaScript code within the Notesnook application's origin context.

On the desktop application, the impact is significantly elevated due to Electron security misconfigurations. The application is configured with nodeIntegration: true and contextIsolation: false, which means JavaScript executing in the renderer process has direct access to Node.js APIs. This allows an attacker to escalate the XSS vulnerability to full remote code execution, enabling arbitrary system commands, file system access, and complete system compromise.

Root Cause

The root cause is twofold: First, the Web Clipper does not properly sanitize or strip dangerous HTML attributes (particularly event handlers) from clipped content before storage. Second, the Electron desktop application uses insecure configuration settings (nodeIntegration: true and contextIsolation: false) that expose Node.js functionality to renderer processes, enabling XSS-to-RCE escalation.

Attack Vector

An attacker can exploit this vulnerability by creating a malicious web page containing event-handler attributes on the root HTML element. When a victim uses the Notesnook Web Clipper to save this page, the malicious attributes are preserved in the stored clip. Upon opening the clip in the desktop application, the event handlers execute, running attacker-controlled JavaScript with full Node.js access due to the insecure Electron configuration.

The attack flow involves the victim visiting a malicious page, using the Web Clipper extension to save content, and later viewing the saved clip in the Notesnook desktop application. The attacker-controlled code then executes with the ability to spawn child processes, access the file system, and perform any operation available to the Node.js runtime.

Detection Methods for CVE-2026-33976

Indicators of Compromise

• Presence of unusual event-handler attributes (onload, onclick, onmouseover, onerror) in stored web clips
• Unexpected child process spawns originating from the Notesnook desktop application
• Evidence of require('child_process') or similar Node.js module loading in application logs

Detection Strategies

• Monitor for web clips containing HTML with suspicious event-handler attributes in the root element
• Implement behavioral analysis to detect unusual process execution patterns from Electron-based applications
• Review stored note content for evidence of JavaScript code attempting to access Node.js APIs

Monitoring Recommendations

• Enable enhanced logging for the Notesnook application to track clip rendering events
• Configure endpoint detection and response (EDR) solutions to alert on suspicious child process creation from Notesnook
• Monitor network connections initiated by the desktop application for signs of command-and-control communication

How to Mitigate CVE-2026-33976

Immediate Actions Required

• Update Notesnook Desktop to version 3.3.11 or later immediately
• Update Notesnook Mobile (Android/iOS) to version 3.3.17 or later
• Review existing web clips for potentially malicious content before opening
• Consider temporarily disabling the Web Clipper extension until updates are applied

Patch Information

Streetwriters has released patched versions that address this vulnerability. Version 3.3.11 for Web/Desktop and version 3.3.17 for Android/iOS include fixes that properly sanitize HTML attributes during the Web Clipper workflow. For more information, refer to the GitHub Security Advisory (GHSA-f42f-phvp-43x5).

Workarounds

• Avoid using the Web Clipper feature to save content from untrusted websites until the application is updated
• Use the web version of Notesnook instead of the desktop application, as RCE escalation is specific to the Electron desktop build
• Apply network-level filtering to block known malicious domains from being clipped

# Verify Notesnook Desktop version (ensure 3.3.11 or later)
# On Windows: Check Help > About in the application
# On macOS: Notesnook > About Notesnook
# On Linux: Help > About or check package manager

# Update via package manager (example for npm-based installation)
npm update notesnook

# For system package managers, use appropriate update commands
# Ubuntu/Debian: sudo apt update && sudo apt upgrade notesnook
# macOS Homebrew: brew upgrade notesnook