CVE-2020-35717
Description
zonote through 0.4.0 allows XSS via crafted notes, leading to remote code execution due to enabled Node.js integration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
zonote through 0.4.0 allows XSS via crafted notes, leading to remote code execution due to enabled Node.js integration.
Vulnerability
zonote is a cross-platform desktop note-taking app built with Electron. Versions through 0.4.0 have webPreferences configured with nodeIntegration: true, which allows JavaScript executed in notes to access Node.js APIs. A crafted note can inject arbitrary JavaScript via cross-site scripting (XSS), enabling remote code execution. [1][2]
Exploitation
An attacker crafts a malicious .znt file containing an XSS payload. The victim imports the file into zonote via Menu > Open. Hovering over links within the imported notes triggers the XSS. No authentication is required; user interaction is limited to importing the file and hovering over the malicious links. [2]
Impact
Successful exploitation allows arbitrary code execution on the victim's machine with the privileges of the zonote process. This can lead to full system compromise, data exfiltration, or further attacks. [1][2]
Mitigation
The repository has been archived and the owner stated no intention to fix the vulnerability. No patch exists. Users should avoid using zonote versions through 0.4.0 and consider alternative note-taking applications. [1][2]
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- zonote/zonotedescription
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
2- medium.com/bugbountywriteup/remote-code-execution-through-cross-site-scripting-in-electron-f3b891ad637mitrex_refsource_MISC
- www.electronjs.org/apps/zonotemitrex_refsource_MISC
News mentions
0No linked articles in our index yet.