The vulnerability exists in versions of Joplin before 3.7.13 when opening a note that contains a jsoncanvas fence. The whiteboard rendering code inserts HTML generated by the Markdown renderer into the main application document using dangerouslySetInnerHTML. A malicious note can include style elements and external CSS links, allowing an attacker to alter the appearance of trusted UI components. Because the application’s Content Security Policy blocks inline scripts, the impact is limited to CSS injection and UI redressing rather than code execution.

The affected product is the Joplin note‑taking application maintained by laurent22. All installations of Joplin where the version is older than 3.7.13 are vulnerable. The fix was released in the 3.7.13 stable release.

The CVSS score of 4.6 indicates a low‑to‑medium severity. No EPSS data or KEV listing is available. The attack vector is local: an attacker must supply a malicious note and a user must open it in the desktop application. Because the vulnerability can be triggered via a shared note, social engineering or a supply‑chain route could lead victims to open the note. The lack of high exploitation probability or KEV status suggests the risk is moderate, but the possibility of UI compromise warrants prompt remediation.