CVE-2026-105784

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.13

Description Selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content using the full Markdown renderer. These components insert the resulting HTML into the main application document via dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports to modify the trusted application chrome, signal when a note is opened, and potentially disclose exposed attribute values. While Content Security Policy prevents inline script execution, the issue allows for CSS injection and UI redressing, which is the act of manipulating the user interface to trick a user into performing an action.

Recommendations Update to version 3.7.13.