| Package | Affected versions | Patched versions |
|---|---|---|
| notesnook desktop | < 3.3.9 | 3.3.9 |
| notesnook mobile | < 3.3.15 | 3.3.15 |
Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>. This vulnerability is fixed in 3.3.9.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free