Joplin Desktop EUVD-2026-84166

Requires the Windows build of Joplin Desktop prior to 3.7.2 (the missing publisherName only affects the Windows NSIS Authenticode verification path). The attacker must control or intercept the update delivery path - a MITM position on the network between client and update host, or a compromised update server/mirror - in order to substitute the app-update.yml metadata and the installer. Exploitation further requires the victim to approve the installation prompt (UI:R): the malicious installer is only accepted after the user clicks through Joplin's normal update-approval flow. Limiting factors: Windows-only, needs active adjacent/on-path control (not a passive remote request), high complexity, and mandatory user interaction; macOS/Linux and default in-transit HTTPS integrity may further raise the bar.

This is a legitimately meaningful supply-chain / update-integrity flaw, but the CVSS 7.1 (AV:A/AC:H/PR:N/UI:R) accurately signals it is NOT a mass-exploitation priority. The vendor vector requires an adjacent position on the update delivery path (AV:A), high attack complexity (AC:H - the attacker must actively intercept/replace update metadata and the installer), and user interaction (UI:R - the victim must approve the malicious installer). No EPSS score, no CISA KEV listing, and no public exploit code were provided, consistent with 'no public exploit identified.' The root cause is real and confirmed by the patch diff (missing publisherName causes electron-updater's NsisUpdater.verifySignature() to skip Authenticode signer comparison), so exploitation is technically sound once an attacker controls the channel - but that channel control (MITM of the HTTPS update fetch, DNS/network compromise, or a compromised update host) is itself a significant prerequisite that gates real-world risk. Net: a genuine defense-in-depth failure worth patching, not an internet-wide remote-code-execution emergency.

An attacker who can intercept or control Joplin's update delivery path (e.g., a MITM position on a shared/hostile network or a compromised update mirror) serves modified app-update.yml metadata pointing to a malicious NSIS installer signed by a different publisher or left unsigned. Because publisherName is absent, the client skips the Authenticode signer comparison, and once the user clicks through the normal update-approval prompt, attacker code runs with the user's privileges. No public exploit code was identified at time of analysis.