« Volver al listado

CVE-2026-31876

Estado: AnalizadaMedia (5.4)—

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>. This vulnerability is fixed in 3.3.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Streetwriters — Notesnook DesktopStreetwriters — Notesnook Mobile

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-31876",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-31876",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T20:08:06.045805Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "streetwriters",
          "product": "notesnook",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.3.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-11T19:16:04.140",
  "references": [
    {
      "url": "https://github.com/streetwriters/notesnook/commit/e87f5e5f899f45df28d7c0f33f15e9178d1fbcb7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-jprx-2w2h-4rh5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>. This vulnerability is fixed in 3.3.9."
    },
    {
      "lang": "es",
      "value": "Notesnook es una aplicación para tomar notas centrada en la privacidad del usuario y la facilidad de uso. Previo a la 3.3.9, existía una vulnerabilidad de cross-site scripting (XSS) almacenado en el componente de incrustación del editor de Notesnook al renderizar URLs de incrustación de Twitter/X. La función tweetToEmbed() en component.tsx interpolaba la URL proporcionada por el usuario directamente en una cadena HTML sin escapar, la cual se asignaba luego al atributo srcdoc de un . Esta vulnerabilidad está corregida en la versión 3.3.9."
    }
  ],
  "lastModified": "2026-06-17T10:34:40.833",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8756DA11-54F2-4580-80D6-B66BDD875599",
              "versionEndExcluding": "3.3.9"
            },
            {
              "criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6F019A8-553F-4070-8235-F57DC7A489F4",
              "versionEndExcluding": "3.3.15"
            },
            {
              "criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EFF2675-83AD-4E81-9DDC-A1706C799A00",
              "versionEndExcluding": "3.3.15"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}