CVE-2026-49449: Joplin: KaTeX \href bypass leaks NTLMv2 hash on Windows

LOWCISA: TRACK*

Published September 21, 2026

CISO Take

Joplin, an open-source note-taking app, enables KaTeX's trust option, so a malicious note can embed a \href link that skips the app's URL allowlist. On Windows, clicking a link to an attacker-controlled UNC path triggers SMB authentication and discloses the user's NTLMv2 challenge-response without any warning. Real-world risk is low: CVSS is 2.5, it needs user interaction and high attack complexity, it is not in CISA KEV, there is no public exploit or Nuclei template, and the SSVC decision is TRACK*. EPSS is 0.00196, though it sits in the 91st percentile, so keep an eye on it. The AI link is thin: this is a general note-taking tool, not an ML component, and it matters mainly where staff keep AI prompts, API keys or research notes in Joplin. Upgrade to Joplin 3.7.2 or later, and block outbound SMB (TCP 445) at the perimeter to cap credential exposure.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Low overall. CVSS 3.1 is 2.5 (AV:L/AC:H/UI:R, limited confidentiality impact). Exploitation needs a victim to open a crafted note and click a rendered link on Windows. The leaked NTLMv2 response could be cracked offline or relayed if SMB signing is not enforced, which raises the impact in poorly hardened Windows environments. No KEV listing, no public exploit and a low EPSS value keep the likelihood down. Exposure for AI/ML systems is indirect.

How does the attack unfold?

Initial Access

The attacker delivers a crafted note with a KaTeX \href pointing to a UNC path via a shared notebook, a sync or an import.

AML.T0011.003

Exploitation

The victim clicks the rendered link, the trusted KaTeX option bypasses the URL allowlist, and pathExists() starts SMB authentication to the attacker's host.

AML.T0106

Credential Capture

The attacker's SMB listener records the user's NTLMv2 challenge-response with no warning shown to the victim.

AML.T0091

Impact

The attacker cracks the hash offline or relays it to reach internal resources, which exposes the credentials and notes the user holds.

Initial Access

The attacker delivers a crafted note with a KaTeX \href pointing to a UNC path via a shared notebook, a sync or an import.

AML.T0011.003

Exploitation

The victim clicks the rendered link, the trusted KaTeX option bypasses the URL allowlist, and pathExists() starts SMB authentication to the attacker's host.

AML.T0106

Credential Capture

The attacker's SMB listener records the user's NTLMv2 challenge-response with no warning shown to the victim.

AML.T0091

Impact

The attacker cracks the hash offline or relays it to reach internal resources, which exposes the credentials and notes the user holds.

How severe is it?

CVSS 3.1

2.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACHigh

PRNone

UIRequired

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade Joplin to 3.7.2 or later. 2) Block outbound SMB (TCP 445) and NetBIOS to the internet at the firewall and endpoint level. 3) Enforce SMB signing and consider disabling NTLM or restricting outgoing NTLM traffic through Windows policy. 4) Avoid importing or syncing notes from untrusted sources until patched, and train users not to click unexpected links in notes. 5) Detect by monitoring for outbound connections to external IPs on port 445 and for NTLM authentication events (Event ID 4648/8004) to unknown hosts. 6) Review shared notebooks for \href links pointing at UNC paths.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageSocial EngineeringPluginAML.T0011.003- Malicious Link AML.T0091- Use Alternate Authentication Material AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified risks and unknown risks are managed

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-49449?

Is CVE-2026-49449 actively exploited?

No confirmed active exploitation of CVE-2026-49449 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49449?

1) Upgrade Joplin to 3.7.2 or later. 2) Block outbound SMB (TCP 445) and NetBIOS to the internet at the firewall and endpoint level. 3) Enforce SMB signing and consider disabling NTLM or restricting outgoing NTLM traffic through Windows policy. 4) Avoid importing or syncing notes from untrusted sources until patched, and train users not to click unexpected links in notes. 5) Detect by monitoring for outbound connections to external IPs on port 445 and for NTLM authentication events (Event ID 4648/8004) to unknown hosts. 6) Review shared notebooks for \href links pointing at UNC paths.

What systems are affected by CVE-2026-49449?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Knowledge management tools, Note-taking applications.

What is the CVSS score for CVE-2026-49449?

CVE-2026-49449 has a CVSS v3.1 base score of 2.5 (LOW). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

Developer workstationsKnowledge management toolsNote-taking applications

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0091Use Alternate Authentication Material

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

Exploitation Scenario

An attacker shares a notebook, a note export or a synced note containing a KaTeX expression with \href pointing to \\attacker-host\share. A Windows user opens the note and clicks the rendered link, expecting a reference. Joplin skips its URL allowlist and calls pathExists() on the UNC path, so Windows sends an SMB authentication attempt. The attacker's listener, such as Responder, captures the NTLMv2 challenge-response, then cracks it offline or relays it to internal services. A target who stores AI project credentials or API keys in their notes is the most useful prize.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-522Insufficiently Protected CredentialsPrimary CWE-829Inclusion of Functionality from Untrusted Control SpherePrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor CWE-522Insufficiently Protected Credentials CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.