joplin
v3.7.22Joplin - the privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.
- Maintenance
- Active526 commits in 3 months · bus factor 1
- License
- OtherUnknown
- Security
- 30 advisories19 high, 9 medium, 2 low · Scorecard 4.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
57.2k stars · 6.4k forks · 672 open issues · last release 17 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 19 high, 9 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-v9jp-q5hw-w3p3Sep 9, 2026Unvalidated `x-success` / `x-error` callback target reaches `shell.openExternal()`
- Affected
- 3.7.10
- Patched in
- >= v3.7
- highCVE-2026-105786Sep 9, 2026Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
- Affected
- <= 3.7.1
- Patched in
- >= v3.7
- mediumCVE-2026-105785Sep 9, 2026Password reset accepts any valid per-user token including CSRF tokens and email-confirmation tokens because the token store has no purpose/type field, enabling full account takeover from a leaked CSRF token or a scanned confirmation-email link
- Affected
- 3.7.0
- Patched in
- >= v3.7
- highCVE-2026-105783Sep 9, 2026Any website open in the browser can trigger and win Joplin's Web Clipper pairing dialog, stealing the permanent full-access API token, because the local server has no Origin/Referer restriction and the confirmation dialog shows no identifying information
- Affected
- 3.7.0
- Patched in
- >= v3.7
- mediumCVE-2026-105784Sep 9, 2026Whiteboard note content is rendered into the main application document, bypassing the note-viewer origin isolation and allowing CSS injection with a remote-controlled exfiltration channel
- Affected
- current dev
- Patched in
- >= v3.7
- highCVE-2026-46649Sep 9, 2026SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
- Affected
- <= 3.3.0
- Patched in
- >= v3.7
- mediumCVE-2026-46650Sep 9, 2026Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
- Affected
- <= 3.5.2
- Patched in
- >= v3.7
- highCVE-2026-49450Sep 9, 2026Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
- Affected
- <= 3.6.14
- Patched in
- 3.7.2
- lowCVE-2026-49449Sep 9, 2026KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
- Affected
- >= 1.4.0, <= 3.7.1
- Patched in
- 3.7.2
- highCVE-2026-49453Sep 9, 2026Path traversal in resource sync — silent arbitrary file write outside the resource directory
- Affected
- <=3.7.1
- Patched in
- 3.7.2
- highCVE-2026-55105Sep 9, 2026Fountain embeds allow arbitrary script execution in published notes and the note viewer
- Affected
- <=3.7.1
- Patched in
- >= v3.7
- highCVE-2026-55210Sep 9, 2026SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
- Affected
- <= 3.7.1
- Patched in
- >= v3.7
- mediumCVE-2026-55179Sep 9, 2026Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
- Affected
- <=3.7.1
- Patched in
- >= v3.7
- highCVE-2026-55456Sep 9, 2026Path traversal vulnerability in sync logic allows a malicious sync target to create and overwrite arbitrary files
- Affected
- <=3.7.1
- Patched in
- 3.6.15, >=3.7.2
- highCVE-2026-59814Sep 9, 2026Stored XSS via inline-served note attachment on published shares
- Affected
- <= 3.7.1
- Patched in
- >= v3.7
- mediumCVE-2026-59816Sep 9, 2026Path traversal in transcribe proxy endpoint via URL-encoded slash (CWE-22)
- Affected
- <= 3.7.1
- Patched in
- >= v3.7
- mediumCVE-2026-59815Sep 9, 2026Pending share recipients can write items into shared folders before accepting invitations
- Affected
- <= v3.6.15
- Patched in
- >= v3.7
- mediumCVE-2025-57798May 15, 2026Denial of Service (DoS) via Uncontrolled Resource Allocation in Joplin Title Input
- Affected
- < 3.3.13
- Patched in
- 3.7.0
- highCVE-2026-22810May 15, 2026Path traversal in OneNote importer allows overwriting arbitrary files
- Affected
- <= 3.5.1; 3.2.2 through 3.5.6; <= 1.3.0
- Patched in
- 3.5.7
- mediumCVE-2026-34600May 15, 2026Logic error in Joplin Server allows share recipients to read notes they no longer have access to
- Affected
- <= 3.5.2
- Patched in
- >= v3.5.3
- highCVE-2025-27409Apr 29, 2025Path traversal in Joplin Server
- Affected
- <= 3.3.3
- highCVE-2025-27134Apr 29, 2025Privilege escalation in Joplin server via user patch endpoint
- Affected
- <= 3.3.2
- Patched in
- 3.3.3
- highCVE-2025-24028Feb 7, 2025XSS in Rich Text Editor allows arbitrary code execution
- Affected
- 3.2.6 - 3.2.11
- lowCVE-2024-55630Feb 7, 2025DOM Clobbering leads to temporary DOS in the note viewer
- Affected
- <= 3.2.3
- highCVE-2025-25187Feb 7, 2025XSS in Goto Anything allows arbitrary code execution
- Affected
- <= 3.1.23
- Patched in
- v3.1.24
- highCVE-2024-53268Nov 25, 2024Lack of validation on openExternal allows XSS
- Affected
- <3.0.3
- Patched in
- 3.0.3
- highCVE-2024-49362Nov 14, 2024XSS on <a> Link in markdown preview
- Affected
- 3.0
- Patched in
- 3.1
- highCVE-2024-40643Sep 6, 2024Parsing error leading to XSS
- Affected
- 3.0.13
- Patched in
- 3.0.15
- highCVE-2023-45673Jun 21, 2024Arbitrary code execution on click of PDF links
- Affected
- < 2.13.3
- Patched in
- 2.13.3
- highCVE-2023-39517Jun 21, 2024XSS when clicking on an untrusted `<map>` link
- Affected
- < 2.12.8
- Patched in
- 2.12.8