medium5.4
CVE-2026-31876
Notesnook is a note-taking app focused on user privacy & ease of use.
Impact
Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>. This vulnerability is fixed in 3.3.9.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Streetwriters | Notesnook Desktop | before 3.3.9 |
| Streetwriters | Notesnook Mobile | before 3.3.15 |