Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105784— Joplin whiteboard card rendering allows CSS injection into application chrome

Quick assessment

Affected
laurent22 joplin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joplin 是一款开源的笔记和待办事项应用程序，它通过笔记本组织笔记和列表。在版本 3.7.13 之前，选择包含 jsoncanvas 围栏（fence）的笔记会导致以下两个组件中的白板文本和文件节点组件使用完整的 Markdown 渲染器渲染卡片内容： 这些组件通过 将生成的 HTML 插入主应用程序文档中。恶意笔记可以注入样式元素和远程 CSS 导入，从而修改受信任的应用程序界面元素、在笔记被打开时发出信号，并可能泄露已暴露的属性值。尽管内容安全策略（CSP）阻止了内联脚本的执行，因此无法实现代码执行，但攻击

CVSS 4.6 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105784

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joplin whiteboard card rendering allows CSS injection into application chrome
Source: CVE Program / CVE List V5
Vulnerability Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
laurent22 joplin < 3.7.13 -

II. Public POCs for CVE-2026-105784

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105784

请登录查看更多情报信息。

Other References for CVE-2026-105784 (4)

Same Patch Batch · laurent22 · 2026-10-05 · 4 CVEs total

CVE-2026-105786 8.5 HIGH Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation
CVE-2026-105783 8.0 HIGH Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
CVE-2026-105785 4.8 MEDIUM Joplin Server password reset accepts tokens issued for unrelated purposes

IV. Related Vulnerabilities

Same product: joplin
Same vendor: laurent22
Same weakness: CWE-79

V. Comments for CVE-2026-105784

No comments yet

Leave a comment