CVE-2026-55105

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2

Description In the packages/renderer/MdToHtml/rules/fountain.ts file, HTML generated by the vendored fountain.js renderer is passed into the note output without sanitization. This allows a malicious Fountain code block to execute scripts when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server. The executed script can read content loaded in the reused note viewer or access data available to an authenticated browser in the server origin if published notes are served from the same domain as server content.

Recommendations Update to version 3.6.15. Update to version 3.7.2.