Joplin uses an unanchored regular expression in isAcceptedUrl to validate internal URLs. This is a Cross‑Site Scripting vulnerability (CWE‑79). Prior to 3.7.2, a javascript: URL containing a matching 32‑character fragment could be considered valid and embedded into an HTML note. After publishing a crafted note as a public share, a user can trigger the script by middle‑click or opening in a new tab, causing the script to run within the Joplin Server origin. The script can read any content visible on the page and make authenticated same‑origin requests on behalf of a logged‑in user, effectively giving an attacker read and write capabilities within the user’s account.

Joplin v3.7.0 through v3.7.1, and any earlier releases prior to 3.7.2, are affected. The issue originates in the Joplin Server component of the laurent22:Joplin application. Users of older Joplin installations who publish notes as public shares are susceptible.

The CVSS score of 4.4 indicates a moderate impact, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to upload a crafted note and the victim to open it in a browser that does not block javascript: navigation. Because the script runs in the same origin as the server, an attacker can read page content and issue authenticated requests, but the attack vector relies on user interaction and specific browser behaviors.