CVE-2026-55105 is a cross-site scripting vulnerability (CWE-79) in the open source note-taking application Joplin. The vulnerability arises because the file packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the embedded fountain.js renderer into note output without proper sanitization. When Fountain rendering is enabled, a malicious Fountain code block can execute arbitrary scripts in the context of the note viewer or published notes served from the same domain. This can lead to unauthorized reading of content loaded in the note viewer or access to data available to authenticated browsers on the server origin. The vulnerability affects Joplin versions prior to 3.6.15 and versions from 3.7.0 up to but not including 3.7.2. The issue has been fixed in versions 3.6.15 and 3.7.2.

The vulnerability allows an attacker to execute arbitrary scripts in the context of the Joplin note viewer or published notes, potentially leading to unauthorized reading of note content or access to sensitive data available to authenticated users on the server origin. This can compromise confidentiality but does not affect integrity or availability directly. The CVSS 3.1 score of 7.7 reflects a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and a scope change with high confidentiality impact.

This vulnerability is fixed in Joplin versions 3.6.15 and 3.7.2. Users and administrators should upgrade to at least these versions to remediate the issue. No additional mitigations are specified or required once the update is applied.