Description (CNA)
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Standard Notes / Standard Notes | affected 0 through v3.201.24 |
CWE
CWE-79
References
- https://proton.me/security/security-advisories
- https://github.com/standardnotes/app/compare/%40standardnotes/desktop%403.201.24...%40standardnotes/desktop%403.201.25
ADP enrichment
No English description supplied.
No references supplied.