Joplin's renderer allows any note author to embed an arbitrary URL using KaTeX with the trust option enabled. The \href URL bypasses Joplin's normal URL allowlist, so when a Windows user clicks the link a UNC path triggers an SMB authentication handshake. The handshake exposes the current user's NTLMv2 challenge-response pair without any warning, allowing the attacker to reconstruct the target password hash. The weakness is an Information Exposure (CWE‑200), improper handling of credentials (CWE‑522) and use‑after‑error (CWE‑829).

The issue affects the Joplin note‑taking application from versions 1.4.0 through 3.7.2, in particular on Windows operating systems where UNC paths are supported. Any user who opens a note created by an attacker could be impacted.

The CVSS score is 2.5, indicating a low base severity, and the vulnerability was not catalogued in CISA KEV or assigned an EPSS score. Nevertheless, the flaw can be exploited by an attacker who supplies a note with a malicious \href link; when a Windows user clicks that link an SMB challenge is sent to the victim machine, revealing NTLMv2 credentials. The attack requires that the victim be a Windows user who has permissions to open the note, and the attacker must craft or modify the note content.