A cross-site scripting vulnerability in Notesnook note-taking app prior to version 3.3.11 can escalate to remote code execution in desktop applications. The vulnerability occurs in the note history comparison viewer when attacker-controlled note headers are displayed using dangerouslySetInnerHTML without proper sanitization. In the desktop version, this XSS can become RCE due to Electron's insecure configuration with nodeIntegration enabled and contextIsolation disabled. The vulnerability can be exploited through the backup and restore feature. Version 3.3.11 contains the security patch.