Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can therefore execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default. The script can read content subsequently loaded in the reused note viewer or, when published notes are served from the same domain as server content, access data available to an authenticated browser in the server origin. This issue is fixed in versions 3.6.15 and 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-21T21:17:05.320Z",
  "pubdate": "2026-09-21T21:17:05.320Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in Joplin due to improper sanitization of HTML generated by the fountain.js renderer. The flaw allows for the injection of arbitrary scripts within Fountain-formatted code blocks.\nThe vulnerability affects both desktop and mobile clients, as well as Joplin Server instances where Fountain rendering is enabled. An attacker can execute malicious scripts within the context of the user's note viewer session.\nImpact includes unauthorized access to note content, potential data exfiltration from the application, and if the note is published on Joplin Server, cross-origin data access if the application shares a domain with sensitive server content.\nThe attack requires the victim to render a maliciously crafted Fountain code block. No specific authentication is required if the attacker can influence the note content, making this a significant risk for users sharing or publishing notes.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the Fountain formatting engine within the Joplin renderer, specifically located in packages/renderer/MdToHtml/rules/fountain.ts. The application utilizes a vendored version of fountain.js to process Fountain syntax into HTML output. During this process, the output generated by the library is directly passed to the application's view layer without passing through a secondary sanitization or HTML purification step.\nWhen a user creates a note containing a maliciously crafted Fountain code block, the renderer fails to strip embedded executable content. Upon rendering the note, the client-side or server-side engine parses the Fountain syntax and interprets the injected HTML tags (such as <script> elements or HTML event handlers like onload/onerror) as legitimate markup, executing them within the browser's document object model (DOM).\nThe attack flow proceeds as follows: First, the attacker embeds a malicious payload within a Fountain-formatted code block in a Joplin note. Second, when the target user opens the note or accesses a published version on a Joplin Server, the affected rendering component processes the untrusted input. Third, the browser executes the payload under the application's origin.\nThe exploitation allows for script execution in the context of the note viewer. This enables an attacker to perform actions such as reading note content loaded in subsequent sessions or stealing session tokens. Furthermore, in environments where published notes are served from the same domain as the Joplin Server's administrative or authenticated endpoints, the script can bypass the same-origin policy to access sensitive server-side data available to an authenticated browser.\nThis vulnerability is present in versions of Joplin prior to 3.6.15 and 3.7.2. The lack of strict output encoding or context-aware sanitization in packages/renderer/MdToHtml/rules/fountain.ts effectively turns the Fountain rendering feature into an injection vector for arbitrary JavaScript execution."
}