CVE-2026-46650

Received Received - Intake

Stored XSS in Joplin Note-Taking App via javascript: URL

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-46650

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin	to 3.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Joplin before 3.7.2 has a flaw in isAcceptedUrl() where an unanchored regex allows javascript: URLs with a specific 32-character path to pass validation. This lets a low-privileged user publish a crafted note as a public share. The script runs in the Joplin Server origin, can read visible content, and make authenticated requests if the victim is signed in.

Detection Guidance

Check Joplin version with 'joplin --version'. If below 3.7.2, the system is vulnerable. Inspect shared notes for suspicious javascript: URLs containing 32-character path fragments.

Impact Analysis

If you use Joplin Server and view a malicious note, clicking the link could execute arbitrary JavaScript in your browser. This may allow attackers to steal data, perform actions on your behalf, or access sensitive information if you are logged in.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is compromised.

Mitigation Strategies

Upgrade Joplin to version 3.7.2 or later immediately. Review and remove any suspicious shared notes containing javascript: URLs.

Hi! I’m here to help you understand CVE-2026-46650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70