CVE-2026-46650

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 4.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Effective score: 4.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-79
Reserved: 2026-05-15
Published: 2026-09-21 21:16 UTC
Last updated: 2026-09-21 21:16 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46650.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 22:16:56 UTC
NVD last modified: 2026-09-21 22:16:56 UTC
NVD CVSS v3.1: 4.4 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability subscore: 1.3 / 10
Impact subscore: 2.7 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84180
Assigner: GitHub_M
Published: Sep 21, 2026, 9:16:12 PM
Updated: Sep 21, 2026, 9:16:12 PM
EUVD base score (CVSS 3.1): 4.4 / 10
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EUVD-reported EPSS: 0.0000
Vendors: laurent22
Products: joplin (< 3.7.2)

ENISA description: Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
laurent22	joplin	`< 3.7.2` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/laurent22/joplin/security/advisories/GHSA-x9vj-jrqf-9wcm x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/15435 x_refsource_MISC
https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e security-advisories@github.com
https://github.com/laurent22/joplin/pull/15435 security-advisories@github.com
https://github.com/laurent22/joplin/security/advisories/GHSA-x9vj-jrqf-9wcm security-advisories@github.com

Remediations (10)

Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege ...

web:arcticwolf.com

Validate Group Policy and registry settings for Defender to ensure real-time protection, automatic remediation , and exclusion policies are secured. Temporary Workarounds Block Vulnerable Apps: Use Microsoft Defender Vulnerability Management to block or warn against execution of affected binaries for systems pending a patch .

2026-09-22 17:11 UTC
Mitigate RedSun Zero-Day Without A Patch | Qualys

web:blog.qualys.com

Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...

2026-09-22 17:11 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-22 17:11 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-22 17:11 UTC
March 10, 2026—Hotpatch KB5079420 (OS Builds 26200.7979 and 26100.7979 ...

web:support.microsoft.com

This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5079420), improves functionality, performance, and reliability. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of ...

2026-09-22 17:11 UTC
Microsoft Patch Tuesday, July 2026 Security Update Review

web:threatprotect.qualys.com

Microsoft's July 2026 Patch Tuesday delivers security updates for a broad range of products and services, including several vulnerabilities that pose significant risks to enterprise environments.

2026-09-22 17:11 UTC
CVE-2026-50656 ShieldBreak Claims Defender Fix Bypass — Megathread

web:windowsforum.com

ShieldBreak, a newly published proof of concept from the researcher known as Nightmare Eclipse, claims to bypass Microsoft's July fix for the Microsoft Defender privilege-escalation flaw CVE - 2026 -50656, better known as RoguePlanet.

2026-09-22 17:11 UTC
July 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 622 vulnerabilities in its July 2026 Patch Tuesday rollout.

2026-09-22 17:11 UTC
Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)

web:www.helpnetsecurity.com

Microsoft has finally released a fix for CVE - 2026 -50656, the Windows Defender LPE vulnerability triggered by the RoguePlanet exploit.

2026-09-22 17:11 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-22 17:11 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46650.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "joplin",
          "vendor": "laurent22",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T21:16:12.297Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/laurent22/joplin/security/advisories/GHSA-x9vj-jrqf-9wcm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-x9vj-jrqf-9wcm"
        },
        {
          "name": "https://github.com/laurent22/joplin/pull/15435",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laurent22/joplin/pull/15435"
        },
        {
          "name": "https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e"
        }
      ],
      "source": {
        "advisory": "GHSA-x9vj-jrqf-9wcm",
        "discovery": "UNKNOWN"
      },
      "title": "Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46650",
    "datePublished": "2026-09-21T21:16:12.297Z",
    "dateReserved": "2026-05-15T20:11:54.585Z",
    "dateUpdated": "2026-09-21T21:16:12.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}