Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T21:17:03.747Z",
  "pubdate": "2026-09-21T21:17:03.747Z",
  "executiveSummary": "Joplin Desktop for Windows prior to version 3.7.2 contains a critical vulnerability in the application update verification process. The issue stems from an omitted 'publisherName' field in the 'packages/app-desktop/package.json' configuration file, which directly impacts the generation of the 'app-update.yml' file used by the auto-updater.\nThis configuration oversight forces the 'NsisUpdater.verifySignature()' function to bypass critical Authenticode signature validation. Consequently, the application fails to verify the identity of the software publisher during an update process. An attacker capable of intercepting or controlling the update delivery path can serve a malicious update, replacing both the legitimate installer and its associated metadata. Because the client skips the signature verification step, it will accept an installer signed by an arbitrary party or an unsigned binary, leading to arbitrary code execution with the privileges of the logged-in user. This compromise allows for the exfiltration of sensitive notes, credentials, and local data, representing a high risk to user security and data integrity.",
  "technicalDetails": "The vulnerability resides within the Joplin Desktop for Windows auto-update mechanism, specifically in how the application manages update metadata via electron-updater and NSIS. The root cause is an insecure configuration in 'packages/app-desktop/package.json' where the 'publisherName' attribute is missing. During the build process, this configuration dictates the contents of 'app-update.yml', which is queried by the client to validate incoming update packages.\nThe 'NsisUpdater.verifySignature()' function relies on the 'publisherName' to perform a comparison between the existing installation’s Authenticode signer and the signer of the downloaded update package. When 'publisherName' is absent, the verification logic defaults to an insecure state, effectively skipping the signature comparison check. This failure ensures that the updater does not validate whether the incoming installer originates from a trusted, authorized source.\nThe attack flow proceeds as follows: First, the attacker must gain the ability to influence the update delivery path, such as through a Man-in-the-Middle (MitM) attack or by compromising the update server infrastructure. Second, when the Joplin application triggers a check for updates, the attacker serves a forged 'app-update.yml' and a malicious executable package. Third, the client retrieves these files and processes the update. Fourth, the 'NsisUpdater' attempts to verify the signature; however, due to the missing 'publisherName' configuration, the verification check is bypassed. Finally, the malicious installer is accepted by the application. Upon user approval—which is often prompted during standard installer execution—the malicious payload is executed under the security context of the user, granting the attacker full access to the user's local file system, including the note database, stored credentials, and synchronization tokens.\nThis vulnerability affects all Joplin Desktop for Windows versions prior to 3.7.2. It requires no authentication by the attacker to exploit, provided they can position themselves within the communication channel between the client and the update repository. The post-exploitation impact is severe, as it facilitates persistent arbitrary code execution and full compromise of the local application state."
}