# CVE-2026-46650: Joplin XSS vulnerability in HTML note links

Source: https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-46650 · Severity: medium · CVSS 4.4 · Published 2026-09-21

Joplin, an open-source note-taking application, contains a cross-site scripting (XSS) vulnerability in its HTML note rendering that allows malicious scripts to execute in a victim's browser. An attacker can create a specially crafted note with a javascript: link that bypasses URL validation and, when shared publicly on Joplin Server, can be triggered to steal data or perform actions on behalf of signed-in users. Exploitation requires user interaction (middle-click or "Open in new tab") and succeeds primarily in older browsers, though current Chrome and Firefox block the attack vector.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-46650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46650 being exploited in the wild.

**How severe is CVE-2026-46650?** Medium severity, with a CVSS score of 4.4, published 21 September 2026.

**Which products and versions are affected?** Joplin prior to 3.7.2.

**Is there a fix for CVE-2026-46650?** A patch was published on 2026-05-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46650 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46650?** Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the isAcceptedUrl() function in packages/renderer/htmlUtils.ts, which uses an unanchored regular expression to validate internal resource URLs. A javascript: URL containing a matching 32-character path fragment can pass validation and be emitted into HTML notes. When executed, the script runs in the Joplin Server origin and can read page-visible content and make authenticated same-origin requests if the victim is signed in. The fix tightens the sanitizer to ensure only legitimate internal links match the resource-URL format.

## Affected products

- Joplin Joplin prior to 3.7.2

## Timeline

- 2026-09-21: disclosed
- 2026-05-15: patched

## References

- [https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e](https://github.com/laurent22/joplin/commit/9fdc2d4adbd7b7326a2d0dcc32e12b705bfc285e)
- [https://github.com/laurent22/joplin/pull/15435](https://github.com/laurent22/joplin/pull/15435)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin cross-site scripting in Fountain code blocks](https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in resource synchronization](https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin denial of service via uncontrolled resource allocation in note titles](https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in)
- [Joplin path traversal in OneNote importer](https://junglewise.ai/threats/cve-2026-22810-joplin-path-traversal-in-onenote-importer)