CVE-2026-46650

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.2

Description The isAcceptedUrl() function in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs. This allows a javascript: URL containing a matching 32-character path fragment to bypass validation and be included in an HTML note link. A low-privileged Joplin Server user can publish a crafted HTML note as a public share. If a victim opens the link via middle-click or by selecting Open in new tab in an older or non-hardened browser, the script executes within the Joplin Server origin. This allows the script to read page-visible content and perform authenticated same-origin requests while the victim is signed in.

Recommendations Update to version 3.7.2.