Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-105784

CVE-2026-105784: Joplin Note-Taking App XSS Vulnerability

CVE-2026-105784 is a cross-site scripting vulnerability in Joplin that allows CSS injection and UI redressing through malicious notes. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-105784 Overview

CVE-2026-105784 is a Cross-Site Scripting flaw [CWE-79] in Joplin, an open source note-taking and to-do application. Versions prior to 3.7.13 render whiteboard card content using the full Markdown renderer and insert the resulting HTML into the main application document via dangerouslySetInnerHTML. Selecting a note that contains a jsoncanvas fence triggers the unsafe render path in TextNode.tsx and FileNode.tsx. A malicious note can inject <style> elements and remote CSS imports that alter trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. The Content Security Policy blocks inline script execution, so the realized impact is CSS injection and UI redressing rather than arbitrary code execution.

Critical Impact

An attacker-controlled note can modify trusted Joplin UI elements, exfiltrate attribute data via CSS selectors, and perform UI redressing against users who open the note.

Affected Products

  • Joplin desktop application versions prior to 3.7.13
  • packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx
  • packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx

Discovery Timeline

  • 2026-10-06 - CVE-2026-105784 published to the National Vulnerability Database
  • 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105784

Vulnerability Analysis

The vulnerability is a stored CSS injection within Joplin's whiteboard editor. When a user selects a note containing a jsoncanvas fence, the whiteboard renders text and file-node cards by passing their contents through the full Markdown renderer. The resulting HTML is then injected into the main application document using React's dangerouslySetInnerHTML, which performs no additional sanitization of structural elements. Because the rendered fragment lands in the trusted application chrome rather than a sandboxed frame, attacker-controlled <style> tags and @import rules affect the entire UI surface. Opening the note is sufficient to activate the payload, and CSS-based attribute selectors can leak values from exposed DOM attributes through requests for remote background images. The Content Security Policy that ships with Joplin blocks inline script execution, which prevents full code execution but does not stop CSS-based UI redressing or data exfiltration.

Root Cause

The root cause is a missing sanitization step between the Markdown renderer and the whiteboard card DOM. The whiteboard components treat Markdown output as safe HTML and emit it directly through dangerouslySetInnerHTML, without stripping <style> elements or filtering stylesheet imports.

Attack Vector

An attacker crafts a note containing a jsoncanvas fence whose card content embeds a <style> block or a remote CSS @import. The attacker then shares or syncs the note to a victim through any supported Joplin channel. When the victim selects the note, the whiteboard renders the hostile markup and applies the attacker's styles to trusted Joplin chrome.

text
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/LinkNode.js
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.js
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/handlePositions.js
+packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/stripUnsafeStyles.test.js
+packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/stripUnsafeStyles.js
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/useCardWheel.js
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/useCheckboxToggle.test.js
packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/useCheckboxToggle.js

Source: GitHub Commit 7fb9ec9. The patch introduces a new stripUnsafeStyles.js module and corresponding tests to remove <style> elements from whiteboard card content before it reaches the DOM.

Detection Methods for CVE-2026-105784

Indicators of Compromise

  • Notes containing a fenced code block with the jsoncanvas language identifier that embed <style> tags or CSS @import statements referencing external hosts.
  • Outbound requests from the Joplin desktop process to unexpected domains that correlate with opening a specific note.
  • Visual anomalies in Joplin application chrome such as replaced icons, modified toolbar text, or overlay elements after opening a shared note.

Detection Strategies

  • Scan the Joplin note database and sync targets for notes containing both ```jsoncanvas fences and <style> or @import directives.
  • Monitor Joplin process network telemetry for CSS resource requests to domains outside the user's normal sync infrastructure.
  • Inspect endpoint telemetry for Joplin desktop versions earlier than 3.7.13 to prioritize at-risk installations.

Monitoring Recommendations

  • Enable application and network telemetry collection on endpoints running Joplin and alert on anomalous outbound HTTP requests sourced from the Joplin binary.
  • Track Joplin version inventory across managed devices and flag any instance running a version below 3.7.13.
  • Review shared notebooks and Joplin sync services for untrusted contributors who could inject hostile jsoncanvas content.

How to Mitigate CVE-2026-105784

Immediate Actions Required

  • Upgrade all Joplin desktop installations to version 3.7.13 or later, which contains the official fix.
  • Audit shared notebooks and incoming sync sources for notes containing jsoncanvas fences from untrusted authors.
  • Remove or quarantine any notes identified as containing embedded <style> elements or remote CSS imports.

Patch Information

The issue is fixed in Joplin 3.7.13. The patch adds a stripUnsafeStyles utility that removes <style> elements from whiteboard card content before it is injected into the DOM. Full details are available in the GitHub Security Advisory GHSA-6h4j-86j4-x4q4, the GitHub Pull Request #16275, and the Joplin v3.7.13 Release Notes.

Workarounds

  • Avoid selecting or opening notes containing jsoncanvas fenced blocks from untrusted sources until the upgrade is applied.
  • Disable or avoid sharing whiteboards with external collaborators until all participating clients are updated to 3.7.13.
  • Restrict Joplin sync endpoints to trusted servers and users to reduce exposure to attacker-controlled notes.
bash
# Verify installed Joplin desktop version and upgrade if below 3.7.13
joplin --version
# On macOS via Homebrew
brew upgrade --cask joplin
# On Linux AppImage, download the 3.7.13 release from the official repository
# https://github.com/laurent22/joplin/releases/tag/v3.7.13

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne