The vulnerability is a stored cross‑site scripting flaw in the note history comparison viewer of the Notesnook web and desktop apps. Attackers can insert malicious HTML in a note header, which is rendered with dangerouslySetInnerHTML without sanitization. When the desktop application subsequently uses the full backup and restore feature, the embedded script runs inside Electron because node integration is enabled and context isolation is disabled, allowing the attacker to execute arbitrary code on the victim's machine.

All users of the Notesnook web and desktop client with versions earlier than 3.3.11 are impacted. This includes the streetwriters:Notesnook Web/Desktop product line. Upgrading to 3.3.11 or later removes the flaw.

The CVSS score is 8.6, indicating a high severity. EPSS is below 1%, suggesting a low probability of widespread exploitation at present. The issue is not listed in CISA’s KEV catalog. The likely attack path involves an adversary crafting a malicious note or note history entry that a legitimate user opens; the script then executes in the desktop context. Because the vulnerability requires the desktop Electron environment, but the initial trigger occurs through the web interface, the attack can be performed against an attacker’s own machine or via a compromised colleague’s session. The combination of a stored XSS and insecure Electron settings turns the flaw into a remote code execution vector.