Joplin, an open source note-taking application, contained an XSS vulnerability (CWE-79) in the isAcceptedUrl() function within packages/renderer/htmlUtils.ts. The function used an unanchored regular expression to validate internal resource URLs, which allowed javascript: URLs containing a specific 32-character path fragment to bypass validation and be embedded in HTML notes. A low-privileged Joplin Server user could publish such a crafted note as a public share. While modern browsers block javascript: URLs on ordinary left-click, exploitation is possible via middle-click or 'Open in new tab' in older or non-hardened browsers. When executed, the malicious script runs in the Joplin Server origin, can read visible page content, and perform authenticated same-origin requests if the victim is signed in. This vulnerability was resolved in Joplin version 3.7.2.

An attacker with low privileges on a Joplin Server can publish a malicious HTML note containing a crafted javascript: URL that may execute script code in the context of the Joplin Server origin. This can lead to disclosure of page-visible content and allow the attacker to perform authenticated requests on behalf of the victim if they are signed in. The attack requires user interaction and is mitigated by modern browser protections against javascript: URLs on left-click navigation.

This vulnerability is fixed in Joplin version 3.7.2. Users and administrators should upgrade to version 3.7.2 or later to remediate this issue. No additional mitigations are required if the update is applied. If upgrading is not immediately possible, users should be cautious about opening public shares in older or non-hardened browsers and avoid middle-click or 'Open in new tab' actions on links within shared notes.