Stored XSS Vulnerability in Notesnook Web/Desktop and Mobile Apps

CVE-2026-42090

What is CVE-2026-42090?

The Notesnook application, a privacy-focused note-taking service, is vulnerable to a stored XSS issue in its export functionality. Specifically, exported notes that contain title, headline, and content fields are directly integrated into an HTML template without proper HTML escaping. This allows malicious scripts to be executed when the note is exported to PDF format, rendering within a same-origin iframe that is not sandboxed. In the desktop version, the situation is exacerbated as Electron's configuration permits node integration and disables context isolation, posing a significant risk of remote code execution. The vulnerabilities have been resolved in the recent updates for both web/desktop and mobile applications.

References