CVE-2026-55105: Joplin Note-Taking App XSS Vulnerability

CVE-2026-55105 Overview

Joplin is an open source note-taking and to-do application that organizes notes into notebooks across desktop, mobile, and server clients. A cross-site scripting flaw [CWE-79] in the Fountain rendering rule allows a malicious note to execute arbitrary JavaScript in the note viewer. The vulnerable code path in packages/renderer/MdToHtml/rules/fountain.ts forwards HTML produced by the vendored fountain.js renderer without sanitization. Attackers can craft a Fountain code block that runs script when a victim opens the note, or when the note is served through Joplin Server with Fountain rendering enabled by default. The issue is fixed in versions 3.6.15 and 3.7.2.

Critical Impact
Attacker-controlled script executes in the note viewer, reading subsequent note content and, on Joplin Server deployments, accessing authenticated browser data in the server origin.

Affected Products

Joplin Desktop client prior to 3.6.15 and 3.7.2
Joplin Mobile client prior to 3.6.15 and 3.7.2
Joplin Server (Fountain rendering enabled by default) prior to 3.6.15 and 3.7.2

Discovery Timeline

2026-09-21 - CVE-2026-55105 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55105

Vulnerability Analysis

Joplin renders Markdown notes into HTML through a chain of rule modules. One of these rules, fountain.ts, handles Fountain-formatted screenplay blocks by delegating parsing to a vendored fountain.min.js renderer. The rule injects the renderer's HTML output directly into the note viewer without passing it through Joplin's HTML sanitizer.

An attacker who controls the contents of a note, whether by sharing it, publishing it, or synchronizing it to a victim's account, can embed a Fountain block that includes hostile markup. When the victim opens the note, the script executes in the note viewer context. In shared browsing contexts, that script can then read subsequently loaded notes in the reused viewer.

When Joplin Server publishes notes from the same origin as authenticated server content, the impact broadens. The script can access data available to the authenticated browser session on the server origin, effectively bridging a public rendering surface to an authenticated user context.

Root Cause

The renderer trusted the HTML output of the third-party fountain.min.js library. The vendored parser does not enforce output escaping, and the calling module did not apply Joplin's htmlUtils sanitizer to the returned markup before insertion into the DOM.

Attack Vector

Exploitation requires an attacker to deliver a note containing a crafted Fountain block. Delivery paths include shared notebooks, synchronized notes on a compromised account, or notes published through Joplin Server. No user interaction beyond opening or viewing the note is required.

typescript

// Patch excerpt from packages/renderer/MdToHtml/rules/fountain.ts
 const fountain = require('../../vendor/fountain.min.js');
+import htmlUtils from '../../htmlUtils';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Theme is defined in @joplin/lib and we don't import it here
 const pluginAssets = function(theme: any) {
// Source: https://github.com/laurent22/joplin/commit/8e0812de9d79d1f0698bb76a8c5d7e991df9748d

The patch imports htmlUtils so the Fountain renderer's output can be sanitized before it reaches the note viewer.

Detection Methods for CVE-2026-55105

Indicators of Compromise

Notes containing Fountain code blocks (fenced with ```fountain) that include HTML tags such as <script>, <img onerror=...>, or <iframe>.
Unexpected outbound network requests initiated by the Joplin desktop or mobile viewer after opening a shared note.
Joplin Server access logs showing requests to published note URLs immediately followed by authenticated API requests from the same browser session.

Detection Strategies

Scan synchronized note stores and Joplin Server databases for Fountain blocks containing HTML event handlers or <script> tags.
Inspect published note HTML output for script content originating from Fountain rendering paths.
Compare installed Joplin client versions against 3.6.15 and 3.7.2 to identify unpatched endpoints.

Monitoring Recommendations

Log and alert on browser-initiated requests from Joplin Server origins that follow public note views within a short time window.
Monitor endpoint process telemetry for the Joplin renderer process making unexpected network connections.
Track Joplin Server admin settings to detect environments where Fountain rendering remains enabled without a patched version.

How to Mitigate CVE-2026-55105

Immediate Actions Required

Upgrade all Joplin desktop, mobile, and server installations to version 3.6.15 or 3.7.2 or later.
Audit shared notebooks and published notes for Fountain blocks containing HTML markup, and revoke sharing where suspicious content is found.
Rotate Joplin Server session credentials for accounts that may have viewed untrusted published notes.

Patch Information

The fix is applied in Joplin 3.6.15 and 3.7.2 through commit 8e0812d and pull request Joplin PR #15659. Full details are in GitHub Security Advisory GHSA-f7q3-3grx-6wg9. The patch routes Fountain renderer output through Joplin's htmlUtils sanitizer before it is inserted into the note viewer DOM.

Workarounds

Disable Fountain rendering in Joplin Server and client configuration until patches are applied.
Restrict note sharing and synchronization to trusted users only during the remediation window.
Host Joplin Server published notes on a separate origin from authenticated server content to limit cross-origin data exposure.

bash

# Verify Joplin client version meets the fixed release
joplin --version
# Expected: 3.6.15, 3.7.2, or later