Read the docs
TI-2026-68385 Aliases CVE-2026-105784

CSS injection in Joplin whiteboard cards alters application chrome

Priority MEDIUM 54CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Joplin before 3.7.13 renders whiteboard card content with its full Markdown renderer and inserts the HTML into the main application document. A low-privilege attacker can supply a malicious note that a user opens, injecting style elements and remote CSS imports that alter the application interface (CWE-79). The impact is CSS injection and UI redressing, since Content Security Policy blocks inline script execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed joplin (laurent22): 3.7.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
laurent22joplinbefore 3.7.133.7.13Patch availableCNA
  • joplin Vendorlaurent22 Affected before 3.7.13 Fixed in 3.7.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:*——laurent22
  • cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:* Versions — — ·laurent22

Remediation

Upgrade Joplin to version 3.7.13, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA joplin (laurent22) Fixed in 3.7.13

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105784
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2023-24472 Arbitrary code execution on click of PDF links in Joplin CVSS 3.1CRITICAL 9.0
  • TI-2024-32950 Remote Code Execution on click of <a> Link in markdown preview CVSS 3.1CRITICAL 9.6
  • TI-2024-27054 Joplin has a parsing error leading to Cross-site Scripting (XSS) CVSS 3.1CRITICAL 9.7
  • TI-2026-34297 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint CVSS 4.0CRITICAL 9.1
  • TI-2025-17795 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin CVSS 3.1CRITICAL 9.6
  • TI-2025-19991 Privilege escalation in Joplin server via user patch endpoint CVSS 3.1HIGH 8.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences