Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-49449Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows

Low 2.5

In plain English

A low-severity information exposure in joplin from laurent22. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)2.5Low

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

Affected products (as reported)

Vendor	Product	Versions
laurent22	joplin	>= 1.4.0, < 3.7.2

Weakness: CWE-200, CWE-522, CWE-829 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/laurent22/joplin/security/advisories/GHSA-9m2r-pv96-jxr3 x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/15538 x_refsource_MISC
https://github.com/laurent22/joplin/commit/b15472bc9654a72101b34b79c9436b3d450e2c10 x_refsource_MISC