CVE-2026-46650: Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Server / Joplinto a version that resolves this vulnerability.Fixed in 3.7.2 - Compensating control
If upgrading to 3.7.2 is not immediately possible, mitigate Stored XSS in the public share viewer by preventing use of javascript: URLs in public note share rendering (e.g., block/strip javascript: links at the application rendering layer or via an HTTP/content sanitization control), since the vulnerability is in isAcceptedUrl() allowing javascript: URLs that bypass validation.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Joplin Server users who view a public share containing a crafted HTML note are exposed. The highest impact is for viewers who are signed in, because successful script execution can make authenticated same-origin requests and read content visible on the page.
What does an attacker need to exploit it?
An attacker needs a low-privileged Joplin Server account and the ability to publish a crafted HTML note as a public share. Exploitation also requires the victim to use a middle-click or open the malicious link in a new tab in an older or non-hardened browser; ordinary left-click is blocked in the current build.
Are current browsers affected in the same way?
No. Current Chrome and Firefox block javascript: URL navigation when opening a link in a new tab, which prevents the demonstrated execution path. Older or non-hardened browsers may still allow execution.
What should be done if patching cannot happen immediately?
Do not open links in public shared HTML notes with middle-click or by using Open in new tab, especially while signed in. Limit access to public shares and avoid viewing untrusted shared notes in browsers that do not block javascript: new-tab navigation.
How can I determine whether my Joplin deployment is affected?
Deployments running a version prior to 3.7.2 are affected. The issue is fixed in Joplin version 3.7.2.