CVE-2026-42090

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42090

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42090.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42090

Aliases

GHSA-fjm8-jg78-89h4

Published

2026-05-04T16:43:07Z

Modified

2026-08-12T03:51:42Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Notesnook: RCE via stored XSS in note export rendering

Details

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version 3.3.20, a stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app. The root cause is that exported note fields such as title, headline, and content are inserted into the generated HTML template without HTML escaping. When the note is later exported to PDF, Notesnook renders that HTML into a same-origin, unsandboxed iframe using iframe.srcdoc = .... Injected script executes in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in Notesnook Web/Desktop version 3.3.15 and Notesnook iOS/Android version 3.3.20.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42090.json"
}

References

Affected packages

Git / github.com/streetwriters/notesnook

Affected ranges

Type

GIT

Repo

https://github.com/streetwriters/notesnook

Events

Introduced

Fixed

9c497fd2bbd7cc303351f0d8576a3d5442c4f16c

Fixed

a4c8259a02698027ccf0981cccccbc75ef72ce23

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*",
        "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.15"
        },
        {
            "fixed": "3.3.20"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.2.0-android

2.2.1-android

2.2.2-android

2.2.3-android

2.2.4-android

2.2.5-android

2.2.6-android

2.3.0-android

2.4.0-android

2.4.1-android

2.4.10-android

2.4.11-android

2.4.12-android

2.4.13-android

2.4.14-android

2.4.15-android

2.4.16-android

2.4.17-android

2.4.2-android

2.4.3-android

2.4.4-android

2.4.5-android

2.4.6-android

2.4.7-android

2.4.8-android

2.4.9-android

2.5.0-android

2.5.1-android

2.5.2-android

2.5.3-android

2.5.4-android

2.5.5-android

2.5.6-android

2.6.0-android

2.6.1-android

2.6.10-android

2.6.11-android

2.6.12-android

2.6.14-android

2.6.15-android

2.6.16-android

2.6.17-android

2.6.18-android

2.6.2-android

2.6.3-android

2.6.4-android

2.6.5-android

2.6.6-android

2.6.7-android

2.6.8-android

2.6.9-android

3.*

3.0.0-android

3.0.0-beta-android

3.0.1-android

3.0.1-beta-android

3.0.10-android

3.0.10-beta-android

3.0.11-android

3.0.12-android

3.0.12-beta-android

3.0.13-android

3.0.13-beta-android

3.0.14-beta-android

3.0.15-android

3.0.15-beta-android

3.0.16-android

3.0.16-beta-android

3.0.17-android

3.0.17-beta-android

3.0.18-android

3.0.2-android

3.0.2-beta-android

3.0.20-android

3.0.21-android

3.0.22-android

3.0.23-android

3.0.24-android

3.0.25-android

3.0.26-android

3.0.27-android

3.0.28-android

3.0.29-android

3.0.3-android

3.0.3-beta-android

3.0.30-android

3.0.31-android

3.0.32-android

3.0.4-android

3.0.4-beta-android

3.0.5-android

3.0.5-beta-android

3.0.6-android

3.0.6-beta-android

3.0.7-android

3.0.7-beta-android

3.0.8-android

3.0.8-beta-android

3.0.9-android

3.0.9-beta-android

3.1.0-android

3.1.0-beta.0-beta-android

3.1.0-beta.1-beta-android

3.1.0-beta.2-beta-android

3.1.0-beta.3-beta-android

3.1.1-android

3.2.0-android

3.2.0-beta.0-beta-android

3.2.0-beta.1-beta-android

3.2.0-beta.2-beta-android

3.2.0-beta.3-beta-android

3.2.0-beta.4-beta-android

3.2.1-android

3.2.10-android

3.2.11-android

3.2.12-android

3.2.2-android

3.2.3-android

3.2.4-android

3.2.5-android

3.2.7-android

3.2.8-android

3.2.9-android

3.3.0-android

3.3.1-android

3.3.10-beta.0-beta-android

3.3.10-beta.3-beta-android

3.3.10-beta.4-beta-android

3.3.10-beta.5-beta-android

3.3.10-beta.6-beta-android

3.3.13-beta.1-beta-android

3.3.14-android

3.3.15-android

3.3.16-android

3.3.19-android

3.3.2-android

3.3.21-android

3.3.22-android

3.3.23-android

3.3.24-android

3.3.3-android

3.3.4-android

3.3.5-android

3.3.9-android

Notesnook Web/Desktop < 3.*

Notesnook Web/Desktop < 3.3.15

Notesnook iOS/Android < 3.*

Notesnook iOS/Android < 3.3.20

v2.*

v2.2.0

v2.2.1

v2.2.2

v2.2.3

v2.2.4

v2.3.0

v2.4.0

v2.4.1

v2.4.10

v2.4.11

v2.4.2

v2.4.3

v2.4.4

v2.4.5

v2.4.6

v2.4.7

v2.4.8

v2.4.9

v2.5.0

v2.5.1

v2.5.2

v2.5.3

v2.5.4

v2.5.5

v2.5.6

v2.5.7

v2.5.8

v2.6.0

v2.6.1

v2.6.10

v2.6.11

v2.6.12

v2.6.13

v2.6.14

v2.6.15

v2.6.16

v2.6.17

v2.6.2

v2.6.3

v2.6.4

v2.6.5

v2.6.6

v2.6.7

v2.6.8

v2.6.9

v3.*

v3.0.0

v3.0.0-beta

v3.0.1

v3.0.10

v3.0.11

v3.0.12

v3.0.13

v3.0.14

v3.0.15

v3.0.16

v3.0.17

v3.0.18

v3.0.2

v3.0.20

v3.0.21

v3.0.22

v3.0.23

v3.0.24

v3.0.25

v3.0.26

v3.0.27

v3.0.28

v3.0.29

v3.0.3

v3.0.30

v3.0.31

v3.0.32

v3.0.4

v3.0.5

v3.0.6

v3.0.7

v3.0.8

v3.0.9

v3.0.9-beta

v3.1.0

v3.1.0-beta.2

v3.1.0-beta.3

v3.1.1

v3.2.0

v3.2.2

v3.2.3

v3.2.4

v3.3.1

v3.3.10

v3.3.11

v3.3.12

v3.3.13

v3.3.14

v3.3.15

v3.3.16

v3.3.17

v3.3.18

v3.3.19

v3.3.2

v3.3.3

v3.3.4

v3.3.5

v3.3.6

v3.3.7

v3.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42090.json"