CVE-2026-55105: stored XSS — HIGH

CISO Take

Joplin, a note-taking app, has a stored cross-site scripting flaw. Before versions 3.6.15 and 3.7.2, its Fountain code block renderer passes unsanitized HTML into note output, so a malicious note can run script in the viewer. The flaw is network-reachable, needs only low privileges and no user interaction, and has a changed scope (CVSS 7.7). Joplin Server publishes notes with Fountain rendering on by default, so script can reach data in an authenticated browser session if published notes share the server's domain. Exploitation likelihood is low-to-moderate (EPSS 0.5%, around the 60th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists. It has no direct AI/ML function, so the relevance is limited to teams that keep AI research notes, prompts, or credentials in Joplin. Upgrade desktop, mobile, and Server deployments to 3.6.15 or 3.7.2 or later. Until then, disable Fountain rendering and avoid serving published notes from the same origin as Joplin Server.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Moderate overall risk. The CVSS is 7.7 because exploitation is simple (network, low complexity, no user interaction) and confidentiality impact is high, but exploitation probability is low (EPSS 0.5%), there is no KEV listing and no public exploit. Exposure is mainly Joplin Server instances that publish notes and share a domain with server content, and clients that open untrusted shared or imported notes with Fountain rendering enabled. AI/ML exposure is indirect: it applies only if sensitive AI-related material such as API keys, prompts, or model research is stored in notes.

How does the attack unfold?

Initial Access

Attacker plants a note with a malicious Fountain code block via a shared notebook, import, or a Joplin Server account.

AML.T0049

Exploitation

The victim opens the note, or the published note page loads, and the unsanitized HTML runs script in the viewer or server origin.

AML.T0011.003

Collection

The script reads content subsequently loaded in the reused viewer or server-origin data available to the authenticated browser.

AML.T0036

Impact

Sensitive note content, such as AI project details, prompts, and credentials, is exfiltrated to an attacker-controlled endpoint.

AML.T0025

Initial Access

Attacker plants a note with a malicious Fountain code block via a shared notebook, import, or a Joplin Server account.

AML.T0049

Exploitation

The victim opens the note, or the published note page loads, and the unsanitized HTML runs script in the viewer or server origin.

AML.T0011.003

Collection

The script reads content subsequently loaded in the reused viewer or server-origin data available to the authenticated browser.

AML.T0036

Impact

Sensitive note content, such as AI project details, prompts, and credentials, is exfiltrated to an attacker-controlled endpoint.

AML.T0025

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

6 steps

Upgrade Joplin desktop, mobile, and Server to 3.6.15 (3.6.x line) or 3.7.2 (3.7.x line) or later.
If patching is delayed, disable Fountain rendering in the Markdown plugin settings on clients and Server.
Serve published notes from a separate origin or domain than the Joplin Server application, so injected script cannot reach server-origin data.
Avoid opening untrusted shared or imported notes, and review recently synced notes for unexpected Fountain code blocks.
Rotate any API keys or secrets stored in notes if suspicious notes were opened.
Add a restrictive Content-Security-Policy on the reverse proxy in front of Joplin Server.

How is it classified?

Data LeakageData ExtractionPluginAML.T0036- Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and mitigation of third-party component risks

Frequently Asked Questions

What is CVE-2026-55105?

Joplin, a note-taking app, has a stored cross-site scripting flaw. Before versions 3.6.15 and 3.7.2, its Fountain code block renderer passes unsanitized HTML into note output, so a malicious note can run script in the viewer. The flaw is network-reachable, needs only low privileges and no user interaction, and has a changed scope (CVSS 7.7). Joplin Server publishes notes with Fountain rendering on by default, so script can reach data in an authenticated browser session if published notes share the server's domain. Exploitation likelihood is low-to-moderate (EPSS 0.5%, around the 60th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists. It has no direct AI/ML function, so the relevance is limited to teams that keep AI research notes, prompts, or credentials in Joplin. Upgrade desktop, mobile, and Server deployments to 3.6.15 or 3.7.2 or later. Until then, disable Fountain rendering and avoid serving published notes from the same origin as Joplin Server.

Is CVE-2026-55105 actively exploited?

No confirmed active exploitation of CVE-2026-55105 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55105?

1. Upgrade Joplin desktop, mobile, and Server to 3.6.15 (3.6.x line) or 3.7.2 (3.7.x line) or later. 2. If patching is delayed, disable Fountain rendering in the Markdown plugin settings on clients and Server. 3. Serve published notes from a separate origin or domain than the Joplin Server application, so injected script cannot reach server-origin data. 4. Avoid opening untrusted shared or imported notes, and review recently synced notes for unexpected Fountain code blocks. 5. Rotate any API keys or secrets stored in notes if suspicious notes were opened. 6. Add a restrictive Content-Security-Policy on the reverse proxy in front of Joplin Server.

What systems are affected by CVE-2026-55105?

This vulnerability affects the following AI/ML architecture patterns: Knowledge management and note-taking platforms, Self-hosted web applications (Joplin Server), Developer productivity tooling.

What is the CVSS score for CVE-2026-55105?

CVE-2026-55105 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

Knowledge management and note-taking platformsSelf-hosted web applications (Joplin Server)Developer productivity tooling

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can therefore execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default. The script can read content subsequently loaded in the reused note viewer or, when published notes are served from the same domain as server content, access data available to an authenticated browser in the server origin. This issue is fixed in versions 3.6.15 and 3.7.2.

Exploitation Scenario

An attacker with a low-privilege Joplin Server account, or one who can share a notebook with a victim, creates a note containing a Fountain code block with embedded script. When the victim opens the note, or an authenticated user visits the published note URL on the same domain as the server, the script runs in the viewer or server origin. It reads the content of subsequently viewed notes, such as AI project notes with API keys or prompt designs, and sends it to an attacker-controlled endpoint.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.