A stored XSS vulnerability exists in the Notesnook mobile share and web clip flow. Attacker-controlled clip metadata, such as the share title, is concatenated into HTML without escaping and then rendered with innerHTML inside the app’s WebView. When a user opens the share flow and selects the web clip option, the malicious payload is injected into the generated HTML and executed in the editor WebView, allowing the attacker to run arbitrary JavaScript within the Notesnook application. This can lead to session hijacking, data theft, or execution of malicious code on the device. The weakness is a typical cross‑site scripting flaw (CWE‑79).

The vulnerability affects the Notesnook note‑taking application developed by Streetwriters. All releases prior to version 3.3.17 on both Android and iOS platforms are impacted. Users of earlier builds should verify their current version against the published release notes.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is likely social‑engineering based, whereby an attacker crafts a malicious title or link preview that is shared with a victim. Because the payload is stored and executed when the victim opens the share flow, an unauthenticated attacker who can influence the share metadata can trigger the exploit. The risk to confidentiality, integrity, or availability depends on the JavaScript executed by the attacker, but the exploitation requires the victim to invoke the share editor with the crafted data.