CVE-2026-46650

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

• CWE-79

• https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e
• https://github.com/laurent22/joplin/pull/15435
• https://github.com/laurent22/joplin/security/advisories/GHSA-x9vj-jrqf-9wcm

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46642draw.io is a configurable diagramming and whiteboarding appl…6.1
• CVE-2026-46643Snappy is a PHP library allowing thumbnail, snapshot or PDF …7.5
• CVE-2026-46644Symfony Polyfill backports PHP features and provides compati…6.9
• CVE-2026-46645SQLAdmin is a flexible Admin interface for SQLAlchemy models…4.3
• CVE-2026-46649Joplin is an open source note-taking and to-do application t…9.1
• CVE-2026-4665The WP Carousel Free plugin for WordPress is vulnerable to S…6.4
• CVE-2026-46654Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to v…8.9
• CVE-2026-46655virtio-win provides Windows paravirtualized drivers for QEMU…7.8
• CVE-2026-46656Bludit is a content management system. Versions prior to 3.2…8.8
• CVE-2026-46657Bludit is a content management system. Versions prior to 3.2…7.1
• CVE-2026-4666The wpForo Forum plugin for WordPress is vulnerable to unaut…6.5
• CVE-2026-46668SpiceDB is an open source database system for creating and m…2.3