CVE-2026-105784: Joplin: CSS injection via jsoncanvas note rendering

MEDIUMCISA: TRACK*

Published October 5, 2026

CISO Take

Joplin, an open source note-taking app, renders jsoncanvas whiteboard cards with the full Markdown renderer and inserts the HTML into the main app document, letting a malicious note inject style elements and remote CSS imports that alter trusted UI. Content Security Policy blocks script execution, so impact is limited to UI redressing, an open-signal beacon when the note is viewed, and possible disclosure of exposed attribute values. Severity is medium (CVSS 4.6), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and the EPSS score of 0.00199 (91st percentile) shows low-to-moderate exploitation interest. This is a general-purpose note-taking tool rather than an AI/ML component, so exposure to AI pipelines is incidental, mainly where teams use shared notebooks to store prompts, runbooks, or credentials. Upgrade Joplin desktop to 3.7.13 or later and avoid opening notes from untrusted sync sources or shares until patched.

Sources:NVDEPSSGitHub Advisory

What is the risk?

Low to medium. Exploitation needs low privileges and user interaction (opening a crafted note), and CSP prevents code execution. Confidentiality and integrity impact are both low. No KEV listing, no public exploit, and EPSS of 0.00199 keep the real-world likelihood modest. Risk rises in organizations that sync shared notebooks with untrusted collaborators.

How does the attack unfold?

Initial Access

Attacker delivers a note with a malicious jsoncanvas fence via a shared notebook, sync target, or import.

Exploitation

Victim selects the note and the whiteboard card renders unsanitized Markdown HTML, injecting style elements and remote CSS imports.

Impact

Injected CSS alters trusted UI, beacons that the note was opened, and may leak exposed attribute values to the attacker.

Initial Access

Attacker delivers a note with a malicious jsoncanvas fence via a shared notebook, sync target, or import.

Exploitation

Victim selects the note and the whiteboard card renders unsanitized Markdown HTML, injecting style elements and remote CSS imports.

Impact

Injected CSS alters trusted UI, beacons that the note was opened, and may leak exposed attribute values to the attacker.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
joplin	—	—	No patch

Do you use joplin? You're affected.

How severe is it?

CVSS 3.1

4.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Joplin desktop to 3.7.13 or later. 2) Until patched, do not open notes containing jsoncanvas fences from untrusted shares, imports, or sync targets. 3) Avoid storing API keys or secrets in notes where possible. 4) Monitor egress for unexpected requests to unfamiliar domains from the Joplin process. 5) Review shared notebooks for notes with jsoncanvas blocks containing style tags or @import rules.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageSocial EngineeringPlugin

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 2.3-Risk treatment and response to identified risks

Frequently Asked Questions

What is CVE-2026-105784?

Is CVE-2026-105784 actively exploited?

No confirmed active exploitation of CVE-2026-105784 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105784?

1) Upgrade Joplin desktop to 3.7.13 or later. 2) Until patched, do not open notes containing jsoncanvas fences from untrusted shares, imports, or sync targets. 3) Avoid storing API keys or secrets in notes where possible. 4) Monitor egress for unexpected requests to unfamiliar domains from the Joplin process. 5) Review shared notebooks for notes with jsoncanvas blocks containing style tags or @import rules.

What systems are affected by CVE-2026-105784?

This vulnerability affects the following AI/ML architecture patterns: Desktop note-taking applications, Shared knowledge bases.

What is the CVSS score for CVE-2026-105784?

CVE-2026-105784 has a CVSS v3.1 base score of 4.6 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

Desktop note-taking applicationsShared knowledge bases

Compliance Controls Affected

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.

Exploitation Scenario

An attacker with write access to a shared Joplin notebook (or who persuades a victim to import a note) adds a jsoncanvas fence whose text node contains a style element with a remote CSS @import. When the victim selects the note, the app renders it and fetches the remote stylesheet, notifying the attacker that the note was opened and revealing the victim's IP address. The CSS can also overlay or restyle application chrome to mislead the user, and attribute selectors with background-image requests can leak exposed attribute values. In an AI-adjacent setting, this could target a team that keeps prompt libraries or tokens in shared notes.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.