CVE-2026-33978

{
  "id": "CVE-2026-33978",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-01T17:28:39.660",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobile share editor WebView. An attacker can control the shared title metadata (for example through Android/iOS share metadata such as TITLE / SUBJECT, or through link-preview title data) and inject HTML such as </a><img src=x onerror=...>. When the victim opens the Notesnook share flow and selects Web clip, the payload is inserted into the generated HTML and executed in the mobile editor WebView. This issue has been patched in version 3.3.17."
    },
    {
      "lang": "es",
      "value": "Notesnook es una aplicación para tomar notas centrada en la privacidad del usuario y la facilidad de uso. Antes de la versión 3.3.17, existe una vulnerabilidad XSS almacenada en el flujo de compartir móvil / clip web porque los metadatos del clip controlados por el atacante se concatenan en HTML sin escapar y luego se renderizan con innerHTML dentro del WebView del editor de compartir móvil. Un atacante puede controlar los metadatos del título compartido (por ejemplo, a través de metadatos de compartir de Android/iOS como TITLE / SUBJECT, o a través de datos de título de vista previa de enlace) e inyectar HTML como </a [tag_HTML_PoC] . Cuando la víctima abre el flujo de compartir de Notesnook y selecciona Clip web, la carga útil se inserta en el HTML generado y se ejecuta en el WebView del editor móvil. Este problema ha sido parcheado en la versión 3.3.17."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "streetwriters",
          "product": "notesnook",
          "versions": [
            {
              "version": "< 3.3.17",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-01T19:07:14.241983Z",
          "id": "CVE-2026-33978",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*",
              "versionEndExcluding": "3.3.17",
              "matchCriteriaId": "105C802D-D317-4B9A-B883-D07A1E0840E6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*",
              "versionEndExcluding": "3.3.17",
              "matchCriteriaId": "858B01C2-38C3-4093-A638-E380119ABDF5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/streetwriters/notesnook/commit/fc8807f74db5539036c5e58d3d68a11ea54098db",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/streetwriters/notesnook/releases/tag/3.3.17-android",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f27j-fqc6-v7pm",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}