CVE-2026-55105

Received Received - Intake

Stored XSS in Joplin via Fountain Code Block

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can therefore execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default. The script can read content subsequently loaded in the reused note viewer or, when published notes are served from the same domain as server content, access data available to an authenticated browser in the server origin. This issue is fixed in versions 3.6.15 and 3.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-55105

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin	to 3.6.15 (inc)
joplin	joplin	to 3.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Joplin is a note-taking app. A vulnerability exists in versions before 3.6.15 and 3.7.2 where HTML generated from Fountain code blocks is not sanitized. This allows malicious Fountain code to execute scripts when rendering is enabled in desktop, mobile, or published notes. The scripts can read note content or access data on the same domain as the server.

Detection Guidance

Check if your Joplin version is below 3.6.15 or 3.7.2. Run 'joplin --version' in terminal or check the app settings. Inspect notes containing Fountain code blocks for unexpected HTML/script content.

Impact Analysis

If you use an affected Joplin version, a malicious note could run scripts to steal data from other notes or access sensitive information if notes are published. Attackers could read your note content or exploit browser access to server data if published notes share a domain.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive user information. Compliance risks include data breaches and failure to protect personal or health data.

Mitigation Strategies

Update Joplin to version 3.6.15 or 3.7.2 or later immediately. Disable Fountain rendering in settings if not needed. Review published notes for malicious content and remove any suspicious notes.

Hi! I’m here to help you understand CVE-2026-55105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70