Executive brief
Notesnook is a privacy-focused note-taking application. A security flaw in the note export process allows a malicious note to execute unauthorized code on a user's computer when they attempt to export the note as a PDF. This could lead to a full compromise of the user's device, including the ability for an attacker to read, write, or delete local files and execute system commands.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the note export flow of Notesnook. Exported note fields (title, headline, and content) are inserted into an HTML template without proper escaping. When a user exports a note to PDF, this HTML is rendered in a same-origin, unsandboxed iframe using 'iframe.srcdoc'. In the desktop application, Electron is configured with 'nodeIntegration: true' and 'contextIsolation: false', allowing injected JavaScript to access Node.js primitives (like 'require') via the parent origin. An attacker can achieve full Remote Code Execution (RCE) by tricking a user into exporting a malicious note. The issue is patched in Web/Desktop version 3.3.15 and Mobile version 3.3.20.
Affected products
- streetwriters Notesnook Web/Desktop < 3.3.15
- streetwriters Notesnook iOS/Android < 3.3.20
Timeline
- 2026-04-20: patched: Desktop version 3.3.15 released
- 2026-04-22: patched: Android version 3.3.20 released
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-04: disclosed: CVE published to NVD