CVE-2026-33955: XSS in Notesnook Web/Desktop

The vulnerability lies in the note history comparison viewer, where attacker-controlled headers are displayed using dangerouslySetInnerHTML without proper sanitization. This allows an attacker to inject malicious JavaScript code. Crucially, the Notesnook desktop application utilizes Electron with nodeIntegration: true and contextIsolation: false, enabling the injected JavaScript to execute within the application's Node.js environment. By crafting a malicious note and leveraging the backup and restore functionality, an attacker can achieve remote code execution on a victim's machine. This represents a significant security risk, potentially allowing attackers to steal sensitive data, install malware, or gain complete control of the affected system.

1. Reserved2026-03-24
2. Published2026-03-27
3. Modified2026-04-03
4. EPSS updated2026-04-04

The primary mitigation is to upgrade Notesnook Web/Desktop to version 3.3.11 or later, which contains the fix for this vulnerability. If immediate upgrading is not possible, consider disabling the backup and restore feature as a temporary workaround. Review all note history comparisons for suspicious content. Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting the note history comparison endpoint. Monitor Notesnook logs for unusual activity, particularly related to note creation and modification. After upgrade, confirm the fix by attempting to inject a simple XSS payload into a note and verifying that it is not executed.