CVE-2026-78325

6.9 Moyenne

Publiée le 07/09/2026 à 14:17 · Modifiée le 09/09/2026 à 17:52 · Analyse NVD reportée · Source : b2fa7fcc-7d08-41f0-853b-11242c5539db

Description

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

Traduire en français

Produits concernés

Standard Notes

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	b2fa7fcc-7d08-41f0-853b-11242c5539db	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-79

Références

https://github.com/standardnotes/app/compare/%40standardnotes/desktop%403.201.24...%40standardnotes/desktop%403.201.25
https://proton.me/security/security-advisories

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories