Notesnook kwetsbaar voor RCE via opgeslagen XSS in Note History diff viewer

The vulnerability lies in the note history comparison viewer, where attacker-controlled headers are displayed using dangerouslySetInnerHTML without proper sanitization. This allows an attacker to inject malicious JavaScript code. Crucially, the Notesnook desktop application utilizes Electron with nodeIntegration: true and contextIsolation: false, enabling the injected JavaScript to execute within the application's Node.js environment. By crafting a malicious note and leveraging the backup and restore functionality, an attacker can achieve remote code execution on a victim's machine. This represents a significant security risk, potentially allowing attackers to steal sensitive data, install malware, or gain complete control of the affected system.

Users of Notesnook Web/Desktop who are using versions prior to 3.3.11 are at risk. This includes individuals and organizations relying on Notesnook for note-taking and collaboration, particularly those who utilize the backup and restore feature. Shared hosting environments where Notesnook is installed could be particularly vulnerable, as a compromised note could affect multiple users.

• javascript / desktop:

// Check for suspicious note content in the history comparison viewer
// Look for <script> tags or event handlers

• generic web:

curl -I https://your-notesnook-instance/note/history | grep -i 'X-XSS-Protection'

• generic web:

# Check access logs for requests containing suspicious characters in note parameters
grep -i '<script' /var/log/apache2/access.log

1. 2026-03-27Disclosure

   disclosure

1. Gereserveerd2026-03-24
2. Gepubliceerd2026-03-27
3. Gewijzigd2026-04-03
4. EPSS bijgewerkt2026-04-04

The primary mitigation is to upgrade Notesnook Web/Desktop to version 3.3.11 or later, which contains the fix for this vulnerability. If immediate upgrading is not possible, consider disabling the backup and restore feature as a temporary workaround. Review all note history comparisons for suspicious content. Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting the note history comparison endpoint. Monitor Notesnook logs for unusual activity, particularly related to note creation and modification. After upgrade, confirm the fix by attempting to inject a simple XSS payload into a note and verifying that it is not executed.