CVE-2026-49449

Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.

Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share; in the current build ordinary left-click is blocked, and demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser.

Joplin, an open source note-taking and to-do application, prior to versions 3.6.15 and 3.7.2, passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default.

Joplin, an open source note-taking and to-do application, prior to versions 3.6.15 and 3.7.2, accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. During background synchronization, ResourceFetcher writes the attacker-controlled resource blob outside the resource directory, allowing creation or overwriting of files at an attacker-chosen existing path.

Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.

Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.

Joplin prior to version 3.5.7 contains a path traversal vulnerability in the importer, allowing arbitrary file overwrite. The OneNote converter does not sanitize embedded file names, enabling ../.. sequences.

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.