External risk intelligence

Notesnook Desktop RCE via Stored XSS in Web Clipper Rendering Flow

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-33976

The vulnerability exists within a client-side note-taking application (Notesnook) and specifically impacts the Web Clipper and desktop/mobile rendering flows. It requires a user to perform a specific action, such as clipping content from a web page, which is then processed locally. It is not an internet-facing service, gateway, or network appliance.

Cross-site Scripting

Streetwriters Notesnook Desktop

before 3.3.11before 3.3.17

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Notesnook note-taking application that could allow for remote code execution on desktop versions. This occurs when the Web Clipper processes certain web content, potentially enabling an attacker to run malicious code on a user's machine if they interact with a specially crafted web clip. The primary concern is to confirm if this specific technology is in use and whether any exposure has occurred.

Stored XSS can lead to code execution.
Desktop app allows remote code execution.
Confirm relevance and any potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a stored cross-site scripting vulnerability in Notesnook's Web Clipper to execute code on a user's desktop. This begins when an attacker crafts a web page containing malicious attributes, which a user then clips using the Notesnook Web Clipper. When the user opens this clipped note, the vulnerable component improperly renders the attacker-controlled HTML within a same-origin iframe, leading to the execution of event-handler attributes. In the desktop application, this can escalate to remote code execution due to insecure Electron configurations.

Entry condition: User must clip malicious content.
Trigger point: Opening a specially crafted note.
Resulting risk: Remote code execution on desktop.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in Notesnook's Web Clipper could allow an attacker to execute arbitrary code on a user's desktop application when a specially crafted note is opened. This occurs because the application improperly handles attributes from source web pages, and when rendered in a same-origin iframe on the desktop, these attributes can trigger malicious code execution due to the Electron environment's configuration.

Desktop application code execution.
Opening a malicious web clip.
Compromise of the user's device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Notesnook application, specifically its desktop version, presents a critical remote code execution vulnerability due to insecure handling of web clipper data. Owners of the Notesnook desktop application and the infrastructure supporting it are the primary responsible parties. The initial action should involve inventorying all Notesnook desktop installations, confirming their accessibility from untrusted sources, and identifying business-critical instances.

Identify Notesnook desktop application owners.
Verify exposure of Notesnook desktop installations.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Notesnook software affected by CVE-2026-33976?

Notesnook is a cross-platform note-taking application that includes a Web Clipper feature designed to save web page content into a user's account. This software stores these clips as HTML, which the application later renders locally when the user views the note. The vulnerability resides specifically within this rendering pipeline, affecting both the desktop application and mobile versions.

What is the nature of this vulnerability?

This issue involves Stored Cross-Site Scripting (CWE-79) and Code Injection (CWE-94). When the Web Clipper saves content, it improperly retains active attributes from the original web page. If a user views that clip later, the application executes these attributes in a sensitive context. On the desktop app, this allows malicious code to escape the application's boundaries, resulting in remote code execution.

How is this vulnerability triggered?

The attack requires a two-step process. First, an attacker must host a webpage containing malicious attributes that the Web Clipper will capture. Second, a user must actively use the clipper on that page and subsequently open the resulting note in the application. Simply having the application installed does not trigger the bug; the user must interact with the specifically crafted clip.

Do I need to worry if I use Notesnook on my local machine?

According to Halo Surface Signal, this is very unlikely to be an internet-facing risk because Notesnook is a client-side application, not a network-facing server or gateway. The risk is localized to the specific device where the note is opened. It is not an issue where an attacker can remotely probe your network, but rather one where you must be induced to save and open malicious external content.

How should I respond to this threat?

The primary response is to update the Notesnook software to the patched versions. For the desktop and web versions, ensure you have updated to at least version 3.3.11. For Android and iOS mobile versions, ensure you are running at least version 3.3.17. Prioritize these updates on any device used to store or view clips from untrusted web sources.

References

github.com/streetwriters/notesnook/security/advisories/GHSA-f42f…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.