CVE-2026-49449

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

• CWE-200
• CWE-522
• CWE-829

• https://github.com/laurent22/joplin/commit/b15472bc9654a72101b34b79c9436b3d450e2c10
• https://github.com/laurent22/joplin/pull/15538
• https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49443authentik is an open-source identity provider. Prior to vers…8.8
• CVE-2026-49444n8n is an open source workflow automation platform. Prior to…8.5
• CVE-2026-49445Cilium is a networking, observability, and security solution…8.8
• CVE-2026-49446Cosmos provides users the ability self-host a home server by…6.1
• CVE-2026-49447Cosmos provides users the ability self-host a home server by…5.3
• CVE-2026-49448authentik is an open-source identity provider. Prior to vers…9.8
• CVE-2026-4945The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenb…5.3
• CVE-2026-49450Joplin is an open source note-taking and to-do application t…7.1
• CVE-2026-49451The OpenAPI.NET SDK contains a useful object model for OpenA…7.5
• CVE-2026-49452WeasyPrint helps web developers to create PDF documents. Pri…6.5
• CVE-2026-49453Joplin is an open source note-taking and to-do application t…7
• CVE-2026-49454Relyra is a strict-by-default SAML 2.0 Service Provider libr…9.1