Advisories · Technology

streetwriters notesnook.

Every CVE that names streetwriters notesnook among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-42090 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Notesnook: RCE via stored XSS in note export rendering
- streetwriters notesnook
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 May 2026
CVE-2026-33978 CVE record

CVSS 5.4 Medium

Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata
- streetwriters notesnook
- Cross-site scripting (XSS)
Not analysed yet 1 Apr 2026
CVE-2026-31876 CVE record

CVSS 5.4 Medium

Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`)
- streetwriters notesnook
- Cross-site scripting (XSS)
Not analysed yet 11 Mar 2026