PatchTheCVECVE-2026-33978: Notesnook is a note-taking app focused on user privacy & ease of use
CVE-2026-33978 is a medium-severity flaw (CVSS 5.4) affecting notesnook mobile, notesnook mobile. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobile share editor WebView. An attacker can control the shared title metadata (for example through Android/iOS share metadata such as TITLE / SUBJECT, or t
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 79%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2026-04-01 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33978?
notesnook mobile: upgrade to 3.3.17; notesnook mobile: upgrade to 3.3.17. Exact commands for each OS are on this page.
Is CVE-2026-33978 being exploited?
CVE-2026-33978 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33978 affect?
CVE-2026-33978 affects notesnook mobile, notesnook mobile. Severity is medium (CVSS 5.4). Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without
How urgent is CVE-2026-33978?
Priority 29/100. Public exploit reference
Software pages
Android vulnerabilities · iOS vulnerabilities
Related CVEs
- CVE-2026-33976 CRITICAL 9.6 UPGRADE UPGRADE Notesnook is a note-taking app
- CVE-2026-42090 CRITICAL 9.6 UPGRADE UPGRADE Notesnook is a note-taking app focused on user privacy & ease of use