Is CVE-2026-46650 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46650 being exploited in the wild.

How severe is CVE-2026-46650?

Medium severity, with a CVSS score of 4.4, published 21 September 2026.

Is there a fix for CVE-2026-46650?

A patch was published on 2026-05-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46650 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46650?

Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46650: Joplin XSS vulnerability in HTML note links

CVE-2026-46650 · Severity: medium · CVSS 4.4 · Published 2026-09-21

Joplin, an open-source note-taking application, contains a cross-site scripting (XSS) vulnerability in its HTML note rendering that allows malicious scripts to execute in a victim's browser. An attacker can create a specially crafted note with a javascript: link that bypasses URL validation and, when shared publicly on Joplin Server, can be triggered to steal data or perform actions on behalf of signed-in users. Exploitation requires user interaction (middle-click or "Open in new tab") and succeeds primarily in older browsers, though current Chrome and Firefox block the attack vector.

Technologies: Joplin. Vendors: Joplin.

Quick answers

Is CVE-2026-46650 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46650 being exploited in the wild.
How severe is CVE-2026-46650?: Medium severity, with a CVSS score of 4.4, published 21 September 2026.
Which products and versions are affected?: Joplin prior to 3.7.2.
Is there a fix for CVE-2026-46650?: A patch was published on 2026-05-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46650 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46650?: Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the isAcceptedUrl() function in packages/renderer/htmlUtils.ts, which uses an unanchored regular expression to validate internal resource URLs. A javascript: URL containing a matching 32-character path fragment can pass validation and be emitted into HTML notes. When executed, the script runs in the Joplin Server origin and can read page-visible content and make authenticated same-origin requests if the victim is signed in. The fix tightens the sanitizer to ensure only legitimate internal links match the resource-URL format.

Affected products

Joplin Joplin prior to 3.7.2

Timeline

2026-09-21: disclosed
2026-05-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.