CVE-2026-33978 Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata

What is CVE-2026-33978?

CVE-2026-33978 is a medium-severity cross-site scripting vulnerability in streetwriters notesnook, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobile share editor WebView. An attacker can control the shared title metadata (for example through Android/iOS share metadata such as TITLE / SUBJECT, or through link-preview title data) and inject HTML such as </a><img src=x onerror=...>. When the victim opens the Notesnook share flow and selects Web clip, the payload is inserted into the generated HTML and executed in the mobile editor WebView. This issue has been patched in version 3.3.17.

Weakness: CWE-79

Which versions are affected by CVE-2026-33978?

It affects 1 product.

Products include Streetwriters Notesnook Mobile.

How do I fix CVE-2026-33978?

No fix has been published for CVE-2026-33978 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-33978 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33978 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f27j-fqc6-v7pm.