CVE-2026-31876

Notesnook before version 3.3.9 was vulnerable to a Stored XSS in the editor embed component when rendering Twitter/X embed URLs. The tweetToEmbed() function in component.tsx interpolated the user-supplied URL directly into an HTML string assigned to the srcdoc attribute of an iframe, enabling scr...