CVE-2026-31876

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string without escaping, which was then assigned to the srcdoc attribute of an <iframe>. This vulnerability is fixed in 3.3.9.

• CWE-79

• https://github.com/streetwriters/notesnook/commit/e87f5e5f899f45df28d7c0f33f15e9178d1fbcb7Patch
• https://github.com/streetwriters/notesnook/security/advisories/GHSA-jprx-2w2h-4rh5Vendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31870cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-31871Parse Server is an open source backend that can be deployed …9.8
• CVE-2026-31872Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-31873Unhead is a document head and template manager. Prior to 2.1…6.1
• CVE-2026-31874Taskosaur is an open source project management platform with…9.8
• CVE-2026-31875Parse Server is an open source backend that can be deployed …5.9
• CVE-2026-31877Frappe is a full-stack web application framework. Prior to 1…9.8
• CVE-2026-31878Frappe is a full-stack web application framework. Prior to 1…5
• CVE-2026-31879Frappe is a full-stack web application framework. Prior to 1…5.4
• CVE-2026-3188A security flaw has been discovered in feiyuchuixue sz-boot-…4.3
• CVE-2026-31881Runtipi is a personal homeserver orchestrator. Prior to 4.8.…9.8
• CVE-2026-31882Dagu is a workflow engine with a built-in Web user interface…7.5