# CVE-2026-55105: Joplin cross-site scripting in Fountain code blocks

Source: https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-55105 · Severity: high · CVSS 7.7 · Published 2026-09-21

Joplin is an open-source note-taking application available on desktop, mobile, and as a server. Attackers can embed malicious code in Fountain-formatted code blocks that executes when the note is viewed or published, potentially reading note content or accessing server data if the application is authenticated to the same domain.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-55105 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55105 being exploited in the wild.

**How severe is CVE-2026-55105?** High severity, with a CVSS score of 7.7, published 21 September 2026.

**Which products and versions are affected?** Joplin before 3.6.15 and before 3.7.2.

**Is there a fix for CVE-2026-55105?** A patch was published on 2026-06-12: Fix merged in versions 3.6.15 and 3.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55105 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55105?** Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Fountain renderer in packages/renderer/MdToHtml/rules/fountain.ts outputs HTML without sanitization, allowing arbitrary script execution when Fountain rendering is enabled. Attack vectors include viewing notes in desktop/mobile clients or accessing published notes through Joplin Server where Fountain rendering is enabled by default. An attacker with the ability to create or modify notes can exploit this to read subsequently-loaded content or, in server deployments, access authenticated browser context data.

## Affected products

- Joplin Joplin before 3.6.15 and before 3.7.2

## Timeline

- 2026-09-21: disclosed
- 2026-06-12: patched: Fix merged in versions 3.6.15 and 3.7.2

## References

- [https://github.com/laurent22/joplin/commit/8e0812de9d79d1f0698bb76a8c5d7e991df9748d](https://github.com/laurent22/joplin/commit/8e0812de9d79d1f0698bb76a8c5d7e991df9748d)
- [https://github.com/laurent22/joplin/pull/15659](https://github.com/laurent22/joplin/pull/15659)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin XSS vulnerability in HTML note links](https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in resource synchronization](https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin denial of service via uncontrolled resource allocation in note titles](https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in)
- [Joplin path traversal in OneNote importer](https://junglewise.ai/threats/cve-2026-22810-joplin-path-traversal-in-onenote-importer)