CVE-2026-42090 - Vulnerability Analysis

Overview

Notesnook prior to Web/Desktop 3.3.15 and iOS/Android 3.3.20 contains a stored XSS caused by unescaped note fields in the export flow, letting attackers execute remote code in the desktop app via unsandboxed iframe, exploit requires crafted note content.

Severity & Score

Impact

Attackers can execute arbitrary code remotely in the desktop app, potentially leading to full system compromise.

Mitigation

Update to Notesnook Web/Desktop 3.3.15 and iOS/Android 3.3.20 or later.

References

• https://github.com/streetwriters/notesnook/releases/tag/3.3.20-android
• https://github.com/streetwriters/notesnook/releases/tag/v3.3.15
• https://github.com/streetwriters/notesnook/security/advisories/GHSA-fjm8-jg78-89h4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner