CVE-2026-49449

Overview

Joplin note‑taking app (v1.4.0‑3.7.2) allows a note author to embed a KaTeX \"\href\" URL that bypasses the normal URL allowlist. On Windows, clicking such a link to an attacker‑controlled UNC path triggers SMB authentication and leaks the current user’s NTLMv2 challenge‑response. The flaw exposes user credentials without any warning.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

Impact

Confidentiality is compromised as the attacker can obtain NTLMv2 challenge‑responses, enabling offline brute‑force or credential reuse attacks. Integrity and availability are not directly affected. The primary victims are Windows users of Joplin who click malicious links in notes, and administrators who share notes containing such links.

Remediation

Update Joplin to version 3.7.2 or later where the KaTeX trust option is disabled. If an update is not immediately possible, disable KaTeX rendering or remove the \"\href\" functionality from notes. Additionally, restrict UNC path access or enforce stricter URL allowlists in the application settings.

Risk context

The CVSS v3 score is 2.5 (low) and no EPSS data is available, indicating a low‑priority issue but still relevant for users who frequently click links in shared notes.

Affected products

• Joplin 1.4.0-3.7.2
• Joplin Desktop