Joplin, an open source note-taking application, had a vulnerability (CVE-2026-49449) in versions >=1.4.0 and <3.7.2 where the KaTeX rendering component enabled the trust option for note content. This allowed a note author to embed a \href URL that bypassed Joplin's URL allowlist. On Windows systems, clicking a link targeting an attacker-controlled UNC path caused the pathExists() function to initiate SMB authentication, disclosing the current user's NTLMv2 challenge-response credentials without warning. Other registered URL handlers could also be invoked via the unfiltered URL, but the primary demonstrated impact was credential disclosure through the KaTeX \href. The issue was resolved in version 3.7.2.

The vulnerability allows an attacker to obtain the NTLMv2 challenge-response credentials of a user who clicks a specially crafted link in a Joplin note on Windows. This exposure of sensitive authentication information could potentially be used in further attacks. The impact is limited by the need for user interaction (clicking the link) and the local vector. The CVSS score is low (2.5), reflecting limited confidentiality impact and high attack complexity.

Upgrade Joplin to version 3.7.2 or later, where this vulnerability is fixed. Until then, users should avoid clicking untrusted links in notes, especially those that may point to UNC paths. No other vendor mitigation or temporary fixes are documented.