Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>.
This vulnerability is fixed in 3.3.9.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 4
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Streetwriters Notesnook_Desktop
cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*
|
— |
3.3.9
|
|
Streetwriters Notesnook_Mobile
cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*
|
— |
3.3.15
|
|
Streetwriters Notesnook_Mobile
cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:ios:*:*
|
— |
3.3.15
|
|
Streetwriters Notesnook_Mobile
cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*
|
— |
3.3.15
|