$joplin logo — CVE-2026-49449; KaTeX \href URL Handling Allows NTLM Credential Disclosure in Joplin$

CVE-2026-49449

Received Received - Intake

KaTeX \href URL Handling Allows NTLM Credential Disclosure in Joplin

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-49449

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin	From 1.4.0 (inc) to 3.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Joplin versions 1.4.0 to 3.7.2. It involves the KaTeX library's trust option being enabled for note content, allowing note authors to insert URLs without proper allowlisting. On Windows, clicking such a link can trigger SMB authentication and leak the user's NTLMv2 challenge-response credentials without warning.

Detection Guidance

This vulnerability involves Joplin's KaTeX rendering allowing unfiltered URLs that could trigger NTLMv2 credential disclosure. To detect it, check if your Joplin version is between 1.4.0 and 3.7.2. Use commands like 'joplin --version' to verify the installed version.

Impact Analysis

If you use Joplin on Windows and click a malicious link in a note, your system may automatically send your NTLMv2 credentials to an attacker-controlled server. This could lead to credential theft and potential unauthorized access to your resources.

Compliance Impact

This vulnerability could lead to credential theft, which may violate data protection requirements under GDPR or HIPAA if sensitive information is exposed. Organizations must ensure proper safeguards to prevent unauthorized access to user credentials.

Mitigation Strategies

Upgrade Joplin to version 3.7.2 or later immediately to patch the vulnerability. Avoid opening notes from untrusted sources until the update is applied.

Hi! I’m here to help you understand CVE-2026-49449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70