CVE-2026-49449

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

CVSS v3 2.5 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/laurent22/joplin/commit/b15472bc9654a72101b34b79c9436b3d450e2c10
https://github.com/laurent22/joplin/pull/15538
https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3
https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3

Configurations

No configuration.

History

28 Sep 2026, 21:17

Type	Values Removed	Values Added
References	~~() https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3 -~~	() https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3 -

21 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 21:17

Updated : 2026-09-28 21:17

NVD link : CVE-2026-49449

Mitre link : CVE-2026-49449

CVE.ORG link : CVE-2026-49449

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-522

Insufficiently Protected Credentials

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-49449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49449", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T20:15:08.128891Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "laurent22", "product": "joplin", "versions": [{"status": "affected", "version": ">= 1.4.0, < 3.7.2"}]}]}], "published": "2026-09-21T21:17:03.593", "references": [{"url": "https://github.com/laurent22/joplin/commit/b15472bc9654a72101b34b79c9436b3d450e2c10", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/pull/15538", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3", "source": "security-advisories@github.com"}, {"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \\href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \\href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2."}], "lastModified": "2026-09-28T21:17:17.913", "sourceIdentifier": "security-advisories@github.com"}