Joplin CVE-2026-46650

Requires a running Joplin Server (public-sharing feature) and an authenticated low-privileged account able to create and publish a note as a public share (PR:L). The crafted href must contain a 32-character [0-9a-zA-Z] path fragment to satisfy the unanchored internal-resource regex in isAcceptedUrl(). Exploitation is strongly LIMITED by required victim interaction (UI:R): ordinary left-click is blocked, so the victim must specifically middle-click or use 'Open in new tab', AND must be using an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. Impact is amplified only when the victim is signed in, enabling authenticated same-origin requests in the Joplin Server origin. Fixed in 3.7.2 by anchoring the regex to the start of the URL.

This is a genuine but low-priority stored XSS. The vendor CVSS of 4.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) is well-calibrated and matches the description: network reachable but high complexity, requiring an authenticated low-privileged Joplin Server user AND victim user interaction. The AC:H rating is strongly justified - the description explicitly states ordinary left-click is blocked in the current build, and modern Chrome/Firefox block javascript: new-tab navigation, so execution only succeeds via middle-click or 'Open in new tab' on an older or non-hardened browser. This browser-hardening dependency is the dominant mitigating factor and separates this from a typical drive-by XSS. No EPSS score, no CISA KEV listing, and no public standalone exploit are provided (the PR ships a regression test with the payload, which is not a weaponized exploit); exploitation status is therefore: no public exploit identified at time of analysis. Signals are consistent rather than conflicting - moderate CVSS, no exploitation intelligence, and heavy environmental gating all point the same direction. This is a legitimate patch-when-convenient issue, not an emergency.

A low-privileged Joplin Server user crafts an HTML note containing a link whose href is a javascript: URL padded with a matching 32-character path fragment (e.g. javascript:/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/;alert(1)) so it slips past the unanchored isAcceptedUrl() regex, then publishes it as a public share. A signed-in victim opens the shared note and middle-clicks or 'Open in new tab's the link in an older or non-hardened browser, causing the script to run in the Joplin Server origin where it can read page-visible content and issue authenticated same-origin requests as the victim. No public standalone exploit exists, though the fix PR (#15435) includes a test case demonstrating the payload.