Joplin Note-Taking Application Vulnerability Affecting Unsecured Resource URLs

CVE-2026-46650

What is CVE-2026-46650?

Joplin, an open-source note-taking and to-do application, contains a vulnerability in its URL validation process used for internal resources. Specifically, the method isAcceptedUrl() employs an unanchored regular expression that inadvertently allows certain javascript: URLs, which contain matching path fragments, to bypass validation. This issue permits a low-privileged user on Joplin Server to create a malicious HTML note and publish it as a public share. Notably, to execute the injected script, a user must interact with the note through specific actions which some browsers may block by default, leading to potential exploitation. The vulnerability has been addressed in version 3.7.2.

References