Joplin CVE-2026-55105

Requires Fountain rendering to be enabled: this is non-default in desktop and mobile clients (user must enable it), but is ENABLED BY DEFAULT when notes are published through Joplin Server. The attacker must be able to get a malicious Fountain code block in front of a victim (authoring/sharing a note or a published note, consistent with PR:L). Impact is amplified when published notes are served from the same domain as server content, allowing access to data available to the authenticated browser in the server origin (the S:C, C:H scenario). Limiting factors: affects only Joplin versions prior to 3.6.15 / 3.7.2, requires Fountain rendering active, and impact is confidentiality-only (no integrity or availability effect).

This is a genuine but conditionally-gated stored XSS (CWE-79) in Joplin, a popular open-source note-taking app. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) reflects a scope-changing script-injection where a malicious Fountain code block executes JavaScript in the note-viewer or, for notes published via Joplin Server, in the authenticated server origin (hence S:C and C:H). The source diff confirms the root cause and fix: fountain.ts previously passed vendored fountain.js HTML output straight into note output, and the patch wraps both titlePageHtml and the script body in htmlUtils.sanitizeHtml() - the added test (sanitize_24) proves an <img onerror=...> payload was rendered live before the fix. Exploitation status is 'no public exploit identified at time of analysis': no CISA KEV listing, no POC referenced, and no EPSS score was supplied. The confidentiality-only impact is real (C:H, I:N, A:N) but exploitation depends on Fountain rendering being enabled - non-default on desktop/mobile but default-on when publishing through Joplin Server - which meaningfully narrows real-world exposure. Net: a legitimate priority for Joplin Server publishing deployments, but not a widespread drive-by threat; treat as medium-priority patch given a fix is confirmed available and no active exploitation is known. Note EPSS/KEV/POC signals are all absent from the input, so risk is assessed from CVSS and the confirmed patch alone.

An attacker authors a note containing a crafted Fountain code block with an HTML/script payload (e.g. <img src=x onerror=...>) and gets it rendered by a victim - either shared/opened in a client with Fountain enabled, or published through Joplin Server where Fountain rendering is on by default. When the victim views it, the unsanitized payload executes in the note viewer and can read content later loaded in the reused viewer or, on a same-domain published server, access data available to the authenticated browser session. No public exploit code is identified, but the fix commit includes a working proof-of-concept payload in its regression test.