CVE-2026-49449

Name of the Vulnerable Software and Affected Versions Joplin versions 1.4.0 through 3.7.1

Description In the packages/renderer/MdToHtml/rules/katex.ts file, the application enables the trust option for KaTeX note content. This allows an author to insert a href URL into the rendered output that bypasses the standard URL allowlist. On Windows systems, clicking a link pointing to an attacker-controlled UNC (Universal Naming Convention) path triggers the pathExists() function to initiate SMB authentication. This process discloses the current user's NTLMv2 challenge-response without warning. Additionally, the unfiltered URL can trigger other registered URL handlers.

Recommendations Update to version 3.7.2.