Notesnook, a note‑taking application, had a stored cross‑site scripting flaw in its Web Clipper rendering flow that can be elevated to full remote code execution on the victim’s machine. The clipper accepts attacker‑controlled attributes from the original page’s root element and stores them in the generated clip HTML. When the clip is later opened, Notesnook writes that HTML into an unsandboxed iframe with the same origin using contentDocument.write. Any event‑handler attributes—such as onload, onclick, or onmouseover—execute in the Notesnook origin. On desktop, the Electron runtime is configured with nodeIntegration set to true and contextIsolation set to false, so the injected code gains full access to the host system, resulting in complete compromise.

The affected products are streetwriters’ Notesnook Web/Desktop and the mobile iOS/Android apps. All pre‑update releases before version 3.3.11 on the Web/Desktop build and before version 3.3.17 on the Android/iOS builds are vulnerable. The patches that fix the issue are released as 3.3.11 for Web/Desktop and 3.3.17 for Android/iOS.

The vulnerability carries a CVSS score of 9.7, indicating critical severity, while the EPSS score is below 1 %, suggesting a low likelihood of active exploitation within the current threat landscape. Notesnook is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious page to a victim’s Web Clipper; the victim must then open the stored clip, at which point the unsandboxed iframe runs the injected code with full Electron privileges, enabling remote code execution.