The vulnerability is a cross‑site scripting flaw in the Evernote and Google Keep note importers within the Standard Notes Android application. Importing a specially crafted .enex or Google Keep HTML file can cause arbitrary JavaScript to run with the app’s privileges, allowing an attacker to steal encryption keys, read or modify note data, and invoke native device APIs. This flaw directly satisfies CWE‑79 and exposes both confidentiality and integrity of user data as well as the device’s native functionality.

The Standard Notes Android app version 3.201.24 and earlier are affected. The vulnerability exists only in the importers for Evernote and Google Keep. No other vendors or product versions are listed as affected.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, suggesting no known out‑of‑band exploitation. Exploitation requires a victim to open or import a malicious file, so the attack vector is user‑initiated and file‑based. Because the flaw triggers within the app’s own process, the impact is confined to the Android application environment, but the ability to read encryption keys compromises all stored notes.