AI Threat AlertCVE-2026-46650: Joplin: XSS via unanchored URL regex in shared notes
MEDIUMPoC AVAILABLECISA: TRACK*Joplin's HTML renderer validates internal resource URLs with an unanchored regular expression, so a javascript: link containing a matching 32-character fragment passes validation. A low-privileged Joplin Server user can publish such a note as a public share, and script runs in the Server origin if a signed-in victim opens the link in a new tab (CVSS 4.4, medium). Exploitation is unlikely at scale: EPSS is 0.28% (top 81%), the vulnerability is not in CISA KEV, and the SSVC decision is Track*. A public PoC exists, but modern Chrome and Firefox block javascript: new-tab navigation, which makes real-world exploitation difficult. Upgrade Joplin and Joplin Server to 3.7.2 or later, and review existing public shares for suspicious javascript: links.
What is the risk?
Low-to-medium. Attack complexity is high and user interaction is required: the victim must middle-click or choose 'Open in new tab' on a crafted link, and current Chrome and Firefox block javascript: navigation. Scope changes because script runs in the Joplin Server origin. A PoC is public, but exploitation likelihood is low (EPSS 0.28%) and there is no KEV listing. The AI relevance is tangential: Joplin is a note-taking tool that may hold sensitive notes or AI-related credentials, not an AI/ML framework.
How does the attack unfold?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Joplin and Joplin Server to 3.7.2 or later (fix in PR #15435). 2) Audit public shares for links using javascript: schemes. 3) Restrict who can publish public shares on self-hosted Joplin Server. 4) Keep browsers current, since modern Chrome and Firefox block javascript: new-tab navigation. 5) Apply a strict Content-Security-Policy on the Joplin Server origin. 6) Advise users not to middle-click or open links from untrusted shared notes in a new tab.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-46650?
Joplin's HTML renderer validates internal resource URLs with an unanchored regular expression, so a javascript: link containing a matching 32-character fragment passes validation. A low-privileged Joplin Server user can publish such a note as a public share, and script runs in the Server origin if a signed-in victim opens the link in a new tab (CVSS 4.4, medium). Exploitation is unlikely at scale: EPSS is 0.28% (top 81%), the vulnerability is not in CISA KEV, and the SSVC decision is Track*. A public PoC exists, but modern Chrome and Firefox block javascript: new-tab navigation, which makes real-world exploitation difficult. Upgrade Joplin and Joplin Server to 3.7.2 or later, and review existing public shares for suspicious javascript: links.
Is CVE-2026-46650 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-46650, increasing the risk of exploitation.
How to fix CVE-2026-46650?
1) Upgrade Joplin and Joplin Server to 3.7.2 or later (fix in PR #15435). 2) Audit public shares for links using javascript: schemes. 3) Restrict who can publish public shares on self-hosted Joplin Server. 4) Keep browsers current, since modern Chrome and Firefox block javascript: new-tab navigation. 5) Apply a strict Content-Security-Policy on the Joplin Server origin. 6) Advise users not to middle-click or open links from untrusted shared notes in a new tab.
What systems are affected by CVE-2026-46650?
This vulnerability affects the following AI/ML architecture patterns: Self-hosted note-taking and knowledge management servers, Shared documentation platforms.
What is the CVSS score for CVE-2026-46650?
CVE-2026-46650 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.28%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003Malicious LinkAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.
Exploitation Scenario
A low-privileged user on a shared Joplin Server publishes an HTML note containing a link whose javascript: URL embeds a 32-character hex fragment to bypass isAcceptedUrl(). The attacker shares the public note URL with a team member who is signed in to the same Server. The victim middle-clicks the link or opens it in a new tab in an older or non-hardened browser, and the script runs in the Server origin. It reads visible content and issues authenticated requests that could expose or modify the victim's notes.
Weaknesses (CWE)
CWE-79Improper Neutralization of Input During Web Page GenerationPrimaryCWE-79Improper Neutralization of Input During Web Page GenerationCWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same attack type: Code ExecutionCVE-2024-291210.0BentoML: RCE via insecure deserialization (CVSS 10)
Same attack type: Code ExecutionCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same attack type: Data LeakageCVE-2025-512010.0smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Data LeakageCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same attack type: Code Execution