CVE-2026-33955

{
  "id": "CVE-2026-33955",
  "sourceIdentifier": "[email protected]",
  "published": "2026-03-27T22:16:22.083",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue."
    },
    {
      "lang": "es",
      "value": "Notesnook es una aplicación para tomar notas. Antes de la versión 3.3.11 en Web/Escritorio, una vulnerabilidad de cross-site scripting almacenada en el visor de comparación del historial de notas puede escalar a ejecución remota de código en una aplicación de escritorio. El problema se activa cuando un encabezado de nota controlado por el atacante se muestra usando “dangerouslySetInnerHTML” sin un manejo seguro. Cuando se combina con la función completa de copia de seguridad y restauración en la aplicación de escritorio, esto se convierte en ejecución remota de código porque Electron está configurado con “nodeIntegration: true” y “contextIsolation: false”. La versión 3.3.11 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "streetwriters",
          "product": "Notesnook Web/Desktop",
          "versions": [
            {
              "version": "< 3.3.11",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-03T03:55:21.973411Z",
          "id": "CVE-2026-33955",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.3.11",
              "matchCriteriaId": "08C11EDB-67C1-4E85-A07D-0164CB036757"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}