What’s Vulnerable › Vulnerabilities

CVE-2020-35717

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-01 · updated 2026-06-17
• Weakness: CWE-79

Description

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).

Affected products

• Electronjs Zonote: through 0.4.0

References

• https://github.com/hmartos/cve-2020-35717
• https://github.com/zonetti/zonote
• https://medium.com/bugbountywriteup/remote-code-execution-through-cross-site-scripting-in-electron-f3b891ad637
• https://www.electronjs.org/apps/zonote
• https://github.com/hmartos/cve-2020-35717
• https://github.com/zonetti/zonote
• https://medium.com/bugbountywriteup/remote-code-execution-through-cross-site-scripting-in-electron-f3b891ad637
• https://www.electronjs.org/apps/zonote

Get alerted when CVE-2020-35717 or the next vulnerability affects your stack