CVE-2026-105784

Executive Summary

CVE-2026-105784 is a cross-site scripting (XSS) vulnerability in Joplin, an open source note-taking and to-do application, affecting versions prior to 3.7.13. When a user opens a note containing a jsoncanvas fence, the WhiteboardEditor "text" and "file-node" components render card content through the full Markdown renderer and inject the resulting HTML into the main application document via dangerouslySetInnerHTML, allowing a malicious note to inject CSS and remote style imports into trusted application chrome. Because the application's Content Security Policy blocks inline script execution, the confirmed impact is limited to CSS injection and UI redressing (CVSS 4.6), with a secondary risk of disclosing exposed attribute values — not arbitrary code execution.

Technical Analysis

Joplin renders certain note content as an interactive "whiteboard" canvas. When a note contains a jsoncanvas fence, the whiteboard editor instantiates node components that display card content. The NVD description identifies two specific components in this rendering path:

• packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx
• packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx

The root cause is an unsafe rendering boundary. These two components feed card content through the full Markdown renderer rather than a restricted/sanitized renderer. The trusted Markdown pipeline permits constructs (such as <style> elements and remote CSS imports) that should never be permitted inside note content. The components then take the renderer output and insert it directly into the main application document using React's dangerouslySetInnerHTML mechanism, which performs no sanitization by default.

The result is stored, DOM-based HTML/CSS injection. The injected markup is placed in the Document Object Model of the trusted Joplin application shell, not in an isolated sandbox or iframe. This is the defining property of the weakness: content that originated from an untrusted note is interpreted in the security context of the application's own user interface.

Critically, the description states that the application's Content Security Policy blocks inline script execution. This bounds the impact. A <style> block or a remote @import of an attacker-controlled stylesheet is not blocked by a script-restricting CSP, so CSS injection succeeds. An injected <script> body does not execute. The vulnerability therefore is best categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation / "Cross-site Scripting") with exploitation constrained to the CSS-injection and UI-redressing sub-class.

Two concrete attacker capabilities flow from CSS injection into trusted chrome:

1. UI redressing / layout manipulation — attacker-controlled CSS can reposition, hide, or spoof trusted interface elements, potentially misleading the user into interacting with attacker-controlled overlays that appear to be legitimate application UI.
2. Data exfiltration signaling and attribute disclosure — remote CSS imports (@import) cause the victim's client to fetch an attacker-controlled stylesheet. The mere act of the fetch acts as a beacon signaling that the note was opened. Beyond signaling, CSS attribute selectors can conditionally load remote resources based on the presence of specific attribute values in the page, creating a channel that can "leak" the existence of exposed attribute values. The NVD description qualifies this as "potentially disclose exposed attribute values."

CVSS 3.1 scoring (4.6, Medium) reflects: Network attack vector (AV:N), Low attack complexity (AC:L), Low privileges required (PR:L), User interaction required (UI:R), Unchanged scope (S:U), Low confidentiality (C:L), Low integrity (I:L), and no availability impact (A:N). The UI:R and S:U components are the primary constraints holding the score low: the attacker cannot inject without the victim opening the note, and the injection stays within the application document's origin rather than crossing a security boundary.

No public proof-of-concept, exploit code, or Nuclei template has been published for this CVE. The analysis above is derived strictly from the NVD description.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored HTML/CSS injection via unsafe Markdown rendering into dangerouslySetInnerHTML) and the specifics named in the NVD description.

1) Reconnaissance / target identification The attacker does not scan for a network service; Joplin is a desktop/Electron application. Instead, the attacker identifies a victim or group of victims who use a vulnerable Joplin version (< 3.7.13) and who consume shared notes. Delivery surfaces include shared notebooks, sync targets, note-exchange workflows, or any channel through which a crafted note can be placed in the victim's Joplin database. The attacker's objective at this stage is simply to get a malicious note into a location the victim will open.

2) Triggering the flaw The attacker authors a note containing a jsoncanvas fence. Inside the canvas, the attacker places card content that will be routed through the WhiteboardEditor's TextNode.tsx and/or FileNode.tsx components. Because these components render with the full Markdown renderer and inject the output via dangerouslySetInnerHTML, the attacker embeds HTML/CSS payload constructs — specifically <style> elements and/or remote @import rules — that survive the Markdown pipeline and reach the application document. The trigger condition is the victim selecting/opening the note containing the jsoncanvas fence.

3) Payload / execution method (vulnerability-class level) The payload is CSS, not JavaScript. It is composed of <style> blocks and remote CSS imports (@import) embedded in the note's canvas card content. When the note is opened, the injected markup is inserted into the trusted application UI. The browser/Electron renderer then parses the attacker CSS and, for remote imports, issues an outbound request to the attacker-controlled stylesheet. Inline <script> does not execute because the Content Security Policy blocks it; the attacker does not obtain script execution and therefore cannot directly read the DOM, cookies, or application secrets through scripted means.

4) Post-exploitation impact Within the confirmed impact envelope, the attacker achieves:

• CSS injection into trusted chrome: attacker styling is applied to the application's own interface.
• UI redressing: the attacker can alter the appearance and positioning of trusted UI, potentially inducing the user to interact with spoofed elements.
• Open-signaling: the remote CSS import fires on note open, giving the attacker a reliable beacon that the note was viewed.
• Potential attribute-value disclosure: CSS attribute selectors combined with conditional remote resource loads can leak the existence of specific attribute values present in the injected document ("potentially disclose exposed attribute values" per NVD).

The attacker does not gain script execution, code execution, or a cross-origin security-boundary break. This is consistent with the low C:L/I:L CVSS subscores and the S:U (unchanged scope) vector.

Impact Assessment

Confidentiality (Low): Limited. The attacker cannot execute script and therefore has no direct read access to the DOM or secrets. However, remote CSS imports and attribute-selector-based conditioning provide a narrow channel that "potentially disclose[s] exposed attribute values" and confirms note-open events to the attacker.

Integrity (Low): Limited but real. The attacker can alter the visual presentation of trusted application UI via injected CSS (UI redressing). Because the injection is into the trusted application chrome rather than an isolated frame, deceived users may be induced to interact with spoofed interface elements.

Availability (None): No denial-of-service impact is described. A:N.

Scope (Unchanged): The injection remains within the application's own document and origin; it does not escalate to a different security context. S:U. This is the primary reason the overall score is capped at 4.6 (Medium).

Blast radius and affected population: Any user running Joplin versions prior to 3.7.13 who opens a note containing a malicious jsoncanvas fence. Because delivery can occur through shared/synced notebooks, collaboration, or note-exchange, the blast radius depends on how widely the crafted note is distributed and how many recipients open it. The attack is stored and persistent in the note database — re-selecting the note re-triggers rendering. User interaction (opening the note) is required, which limits mass, unattended exploitation.

Business context: Joplin is widely used by knowledge workers, engineers, and security personnel for note-taking; notes frequently contain sensitive operational and personal information. While this CVE does not yield code execution, successful UI redressing in a trusted application shell is a credible phishing/credential-deception vector, and the note-open beaconing gives attackers campaign feedback. Enterprise relevance is moderate: the app is typically user-installed rather than centrally managed, so inventory and enforcement of the fixed version depend on endpoint detection and patch-management for developer/end-user desktop software.

Detection Guidance

Sigma Rule

Detects Joplin installation/execution where the running binary predates the fixed version, and flags note-store activity consistent with jsoncanvas whiteboard content carrying embedded style/import markup. Adjust paths to your environment.

title: Joplin Pre-3.7.13 Whiteboard JSONCanvas CSS Injection Activity
id: 3f6c1a24-8b7e-4d52-9c11-7a0e5d2b9f10
status: experimental
description: Detects execution of vulnerable Joplin builds and note-content artifacts consistent with CVE-2026-105784 jsoncanvas CSS injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105784
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\joplin.exe'
  filter_fixed:
    CommandLine|contains: '3.7.13'
  condition: selection_process and not filter_fixed
falsepositives:
  - Legitimate updated Joplin installations (version detection is imperfect via CLI)
  - Administrative inventory scripts
level: low
---
title: Joplin Note Containing JSONCanvas Fence With Embedded Style or Remote CSS Import
id: 8d1b6e03-2c94-4a77-b0e2-9f3a1c6d4e21
status: experimental
description: Detects file/registry artifacts or note-store writes where Joplin note content contains a jsoncanvas fence plus style elements or @import remote CSS (CVE-2026-105784).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105784
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection_file:
    TargetFilename|contains:
      - '\Joplin\'
      - '\.config\joplin'
      - 'joplin-desktop'
  selection_content:
    # Requires file-content inspection or endpoint DLP telemetry
    Contents|contains|all:
      - 'jsoncanvas'
    Contents|contains:
      - '<style'
      - '@import'
  condition: selection_file and selection_content
falsepositives:
  - Legitimate notes with embedded styling
level: medium

YARA Rule

Scans note-store artifacts and shared note files for the jsoncanvas fence combined with style/import injection markers.

rule CVE_2026_105784_Joplin_JSONCanvas_CSSInjection
{
    meta:
        description = "Detects Joplin jsoncanvas notes carrying embedded style/CSS-import injection for CVE-2026-105784"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105784"
        severity = "medium"

    strings:
        $c1 = "```jsoncanvas" ascii nocase
        $c2 = "jsoncanvas" ascii nocase
        $s1 = "<style" ascii nocase
        $s2 = "@import" ascii nocase
        $s3 = "url(" ascii nocase
        $s4 = "dangerouslySetInnerHTML" ascii
        $u1 = /https?:\/\/[a-z0-9.\-]+\/[^ \r\n"']*\.css/ ascii nocase

    condition:
        ($c1 or $c2) and ($s1 or $s2 or ($s3 and $s4) or $u1)
}

Suricata IDS Rule

Detects the network-side beacon: the Joplin client fetching a remote stylesheet referenced by an injected @import/url() when a malicious note is opened.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-105784 Joplin JSONCanvas Remote CSS Beacon"; flow:to_server,established; http.method; content:"GET"; http.header; content:"Accept"; http.header; content:"text/css"; http.uri; content:".css"; pcre:"/Accept\x3a\x20[^\r\n]*text\/css/i"; threshold:type limit, track by_src, count 5, seconds 60; metadata:cve CVE-2026-105784; classtype:attempted-recon; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105784; sid:2026105784; rev:1;)

Elastic Detection

EQL hunting for Joplin child processes or note-store file writes followed by an immediate outbound HTTP transaction to a .css URL — a potential open-beacon pattern. Tune to your telemetry schema.

sequence by host.id with maxspan=5s
  [ process where process.name in ("joplin.exe", "joplin", "electron") ]
  [ network where event.category == "network" and
      network.direction == "egress" and
      (endsWith(network.destination.port, "80") or network.destination.port == 443) and
      stringContains(url.full, ".css") ]

Splunk SPL Query

Identifies Joplin note-open activity correlated with remote stylesheet fetches (proxy or web-gateway logs), and flags vulnerable Joplin process executions.

(index=proxy OR index=web) (uri_path="*.css")
| rex field=uri_path "(?<css_host>[^/]+)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, css_host, uri_path
| where count >= 1
| append [
    search index=endpoint (process_name="joplin.exe" OR process_name="joplin")
    | where NOT match(process_version, "^3\.7\.1[3-9]|^3\.[89]")
    | table _time, host, process_name, process_version
]

Wazuh OSSEC Rule

Detects creation/modification of Joplin note-store files containing jsoncanvas and style/import injection markers, and flags vulnerable-version process starts.

<group name="joplin,cve-2026-105784,">
  <rule id="105784" level="6">
    <decoded_as>syscheck</decoded_as>
    <field name="file">\.(md|json)$</field>
    <match>joplin</match>
    <description>CVE-2026-105784: Joplin note store modified (potential jsoncanvas CSS injection content)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>

  <rule id="105785" level="10">
    <if_sid>105784</if_sid>
    <match>jsoncanvas</match>
    <description>CVE-2026-105784: Joplin note with jsoncanvas fence written to store</description>
  </rule>

  <rule id="105786" level="10">
    <if_sid>105784</if_sid>
    <regex>(&lt;style|@import|https?://[^ ]+\.css)</regex>
    <description>CVE-2026-105784: Joplin note contains embedded style or remote CSS import</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 3.7.13, but no vendor advisory, commit, or patch source has been confirmed by tracked vulnerability feeds; treat the 3.7.13 reference as the stated fix target and verify independently against the vendor before relying on it.

1) Immediate mitigations (before patching is possible)

• Treat notes containing jsoncanvas fences from untrusted or shared sources as untrusted content; do not open them in a vulnerable Joplin build.
• Restrict the delivery surface: limit or disable syncing of notes from shared notebooks from unknown parties into the vulnerable client until updated.
• Where feasible, apply an application-layer/network control that blocks egress to unexpected remote .css origins from the Joplin/Electron process, which disrupts the beaconing and attribute-leak channel central to the confirmed impact.
• Note that Joplin's Content Security Policy already blocks inline script execution, which is why the supported impact is limited to CSS injection and UI redressing rather than code execution; do not weaken the CSP, as it is the control containing the blast radius.

2) Patch / upgrade steps

• Upgrade Joplin to version 3.7.13 or later, the version named as the fix in the NVD description.
• Verify the obtained build directly from the vendor's official distribution channel and confirm the version in the application's About dialog after install.
• Rotate/re-validate any sensitive content if a user is suspected of having opened a malicious note, particularly if UI-redressing interactions (e.g., entering credentials into spoofed chrome) are suspected.
• Re-sync note stores only after all clients that share the store have been upgraded, to avoid re-introducing a crafted note to a still-vulnerable client.

3) Long-term hardening

• Track Joplin advisories and apply updates promptly; the fixed version is a single-release fix, so inventory lag is the primary exposure driver.
• For organizations that manage desktop/Electron apps, add Joplin to endpoint software inventory and enforce minimum-version policy.
• In shared/collaborative note workflows, adopt trust boundaries for imported content and review content rendered through Markdown pipelines for unsafe HTML passthrough.
• Monitor egress from note-taking/Electron clients to unexpected stylesheet origins as a persistent detection backstop against CSS-injection exfiltration channels.

References

• NVD — CVE-2026-105784: https://nvd.nist.gov/vuln/detail/CVE-2026-105784
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS: Not yet scored for this CVE (do not rely on an EPSS value until FIRST publishes one): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog: This CVE is not listed in KEV. Check status directly: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Joplin project (vendor) release notes and security advisories: verify the 3.7.13 fix against the official project channel before relying on it, as no patch source is confirmed by tracked feeds.

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild activity has been identified for CVE-2026-105784 at the time of writing. No threat actor campaigns are known to be associated with this CVE.