CVE-2026-49449: Joplin Note-Taking App Credential Disclosure

CVE-2026-49449 Overview

Joplin is an open source note-taking and to-do application that organizes notes into notebooks. CVE-2026-49449 affects versions from 1.4.0 until 3.7.2, where packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content. This allows a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. The flaw is classified under CWE-200: Exposure of Sensitive Information.

Critical Impact
On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without warning.

Affected Products

Joplin Desktop versions 1.4.0 through 3.7.1
Windows platform (primary impact vector via SMB/UNC handling)
Fixed in Joplin version 3.7.2

Discovery Timeline

2026-09-21 - CVE-2026-49449 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-49449

Vulnerability Analysis

Joplin renders mathematical content using KaTeX, a TypeScript library that supports commands like \href and \url for embedding hyperlinks. The renderer configured KaTeX with trust: true, which instructs KaTeX to accept arbitrary URLs in these commands.

Joplin normally routes Markdown links through an allowlist (htmlUtils.isAcceptedUrl) that restricts protocols to safe schemes. KaTeX-generated links bypassed this filter entirely. A malicious note author could embed a \href command pointing to a UNC path such as \\attacker.example.com\share\file.

When the recipient clicked the link on Windows, Joplin invoked pathExists() on the UNC target. Windows automatically initiates SMB authentication against remote hosts, transmitting the user's NTLMv2 challenge-response. An attacker capturing this handshake can perform offline cracking or NTLM relay attacks against internal services.

Root Cause

The root cause is misconfiguration of KaTeX's trust option in packages/renderer/MdToHtml/rules/katex.ts. Setting trust: true disables KaTeX's built-in URL protocol filtering for \href and \url. The unfiltered URL could also invoke other registered URL handlers on the operating system.

Attack Vector

Exploitation requires an attacker to author a Joplin note containing crafted KaTeX markup and share it with a target. The victim must open the note and click the rendered link. The demonstrated impact is credential disclosure via SMB authentication to attacker-controlled infrastructure.

typescript

// Security patch: Restrict KaTeX \href to safe URL schemes
// File: packages/renderer/MdToHtml/rules/katex.ts

interface KatexTrustContext {
    command: string;
    url?: string;
    protocol?: string;
}

interface KatexOptions {
    macros?: Record<string, string | KatexMacro>;
    displayMode?: boolean;
    trust?: boolean | ((context: KatexTrustContext) => boolean);
}

// KaTeX's `\href` and `\url` commands accept arbitrary URLs when trust is
// `true`, including `file://` and UNC paths that bypass Joplin's link
// allowlist. Restrict to the same schemes accepted by htmlUtils.isAcceptedUrl
// for regular Markdown links.
const isTrustedKatexContext = (context: KatexTrustContext): boolean => {
    if (context.command !== '\\href' && context.command !== '\\url') return false;
    const url = (context.url || '').toLowerCase();
    return url.startsWith('https://')
        || url.startsWith('http://')
        || url.startsWith('mailto:')
        || url.startsWith('joplin://')
        || /^#[a-zA-Z0-9-]+$/.test(url)
        || /^:\/[0-9a-zA-Z]{32}(\/.*)?$/.test(url);
};

Source: Joplin commit b15472bc

Detection Methods for CVE-2026-49449

Indicators of Compromise

Joplin notes containing KaTeX markup with \href commands referencing file:// or UNC path targets (\\host\share)
Outbound SMB traffic (TCP 445) from Joplin desktop hosts to unrecognized external destinations
NTLMv2 authentication attempts against internet-facing hosts originating from workstation processes

Detection Strategies

Inspect Joplin note repositories and sync targets for Markdown content containing \href patterns pointing to non-HTTP schemes
Monitor endpoint DNS resolutions and TCP 445 egress from Joplin.exe to destinations outside the corporate network
Alert on outbound SMB session establishment initiated by desktop productivity applications

Monitoring Recommendations

Enable Windows Security auditing for outbound NTLM authentication events (Event ID 8001-8004)
Deploy network egress filtering to block TCP 445 and TCP 139 at the perimeter
Review Joplin sync sources to identify untrusted notebooks shared from external collaborators

How to Mitigate CVE-2026-49449

Immediate Actions Required

Upgrade Joplin Desktop to version 3.7.2 or later on all Windows endpoints
Block outbound SMB traffic (TCP 445, TCP 139) at network egress points to prevent NTLM credential leakage
Audit shared Joplin notebooks and sync sources for untrusted authors before opening notes

Patch Information

The fix is available in Joplin version 3.7.2. The patch introduces a callback-based trust function (isTrustedKatexContext) that restricts KaTeX \href and \url commands to the same schemes accepted by htmlUtils.isAcceptedUrl: https://, http://, mailto:, joplin://, anchor fragments, and Joplin resource identifiers. Review the GitHub Security Advisory GHSA-9m2r-pv96-jxr3 and Pull Request #15538 for details.

Workarounds

Avoid opening Joplin notes from untrusted sources until the upgrade is applied
Apply Windows Group Policy restrictions on outgoing NTLM authentication to remote servers
Configure host firewall rules to block SMB traffic originating from Joplin.exe

bash

# Windows firewall rule to block outbound SMB from Joplin
New-NetFirewallRule -DisplayName "Block Joplin SMB Outbound" `
    -Direction Outbound `
    -Program "C:\Program Files\Joplin\Joplin.exe" `
    -Protocol TCP `
    -RemotePort 445,139 `
    -Action Block

# Restrict outgoing NTLM via Group Policy
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > Security Options >
# Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
# Set to: Deny all