Notesnook, a privacy‑focused note‑taking application, contains a stored cross‑site scripting flaw in the export flow. Exported note fields such as title, headline, and content are inserted into an HTML template without escaping. When the note is later exported to PDF, Notesnook renders that HTML in an unsandboxed, same‑origin iframe using iframe.srcdoc. In desktop versions built with Electron, nodeIntegration is enabled and contextIsolation is disabled, allowing injected script to run with full Node.js privileges and thus achieving remote code execution on the victim’s machine.

The vulnerability affects Streetwriters Notesnook Web and Desktop releases before version 3.3.15 and iOS/Android releases before version 3.3.20. Any user running these versions and exporting notes that contain attacker‑supplied JavaScript is at risk.

The flaw carries a CVSS score of 9.6, indicating critical severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog. The attack requires the ability to create or influence a note that will be exported; this requirement is inferred from the description of the export flow. Because the injected payload is stored and executed locally, the exploitation probability is high for users who export notes containing malicious content, making this a serious local vulnerability.