Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-21T22:16:56.480Z",
  "pubdate": "2026-09-21T22:16:56.480Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Joplin prior to version 3.7.2 due to insufficient input validation within the URL sanitization logic.\nThe vulnerability originates in the isAcceptedUrl() function, which utilizes an unanchored regular expression that fails to properly restrict URL protocols.\nBy crafting a malicious javascript: URI containing a specific 32-character path fragment, an attacker can bypass security checks, allowing the injection of arbitrary JavaScript into HTML notes.\nWhen a victim views a public share containing the crafted note, the payload executes within the context of the Joplin Server origin.\nThis allows an attacker to access sensitive information visible on the page and perform unauthorized authenticated actions on behalf of the victim.\nExploitation requires a user to interact with the link, though browser-level protections in modern Chrome and Firefox have mitigated simple left-click execution, necessitating middle-click or 'Open in new tab' actions in non-hardened environments.\nThe vulnerability is limited to low-privileged users with the capability to publish notes, but the impact is significant due to potential session compromise.",
  "technicalDetails": "The vulnerability is located in the packages/renderer/htmlUtils.ts file within the isAcceptedUrl() function. The root cause is the use of an unanchored regular expression intended to validate internal resource URLs. Because the regex lacks proper start and end anchors, it allows for bypasses when a malicious payload—specifically a javascript: protocol URI—contains a substring that satisfies the regex's pattern matching requirements, including a required 32-character path fragment.\nThe attack flow begins with a low-privileged Joplin Server user creating a note containing a maliciously crafted hyperlink. By embedding a javascript: URI that masquerades as an internal resource due to the regex flaw, the malicious link is successfully processed by the renderer and emitted into the HTML output.\nOnce the note is published as a public share, it becomes accessible to other users. When an unsuspecting victim navigates to this note, the link becomes actionable. In older or less secure browser configurations, clicking the link triggers the execution of the embedded script.\nExecution occurs in the origin of the Joplin Server, providing the attacker's script the same security context as the legitimate application. This enables the script to perform several actions: reading sensitive, page-visible content within the note or the dashboard, and executing authenticated same-origin requests. Since these requests are performed while the victim is logged into their session, the browser automatically attaches the necessary authentication cookies.\nWhile modern browsers such as Chrome and Firefox have implemented protections that block javascript: URI navigation via direct left-click in specific contexts, the payload can still be triggered via alternative user interactions such as middle-click or 'Open in new tab' if the browser's security hardening is not fully realized against this specific injection vector.\nThe vulnerability affects all versions of Joplin prior to 3.7.2. The primary technical requirement for successful exploitation is the ability for an attacker to publish content that the application renderer will process and display to other users, specifically targeting the server-side rendering logic."
}