CVE-2026-55105

Executive Summary

CVE-2026-55105 is a stored/reflected cross-site scripting (XSS) vulnerability in Joplin, an open-source note-taking and to-do application, affecting versions prior to 3.6.15 and 3.7.2. The flaw exists because the vendored Fountain.js renderer output is passed into note output without sanitization in packages/renderer/MdToHtml/rules/fountain.ts. An attacker who can supply a malicious Fountain code block can execute arbitrary script in the context of the Joplin desktop/mobile client viewer or, when published notes are served from the same origin as Joplin Server content, in the server origin — enabling theft of subsequent note content and authenticated server-origin data.

Technical Analysis

Joplin renders Markdown notes through a renderer pipeline that supports multiple embedded code-block languages. One such language is Fountain, a plain-text screenplay markup format. The renderer invokes a vendored copy of fountain.js to convert Fountain blocks into HTML. According to the NVD description, the rule located at packages/renderer/MdToHtml/rules/fountain.ts passes the HTML produced by that vendored renderer directly into the final note output without sanitizing it.

This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: the renderer trusts the HTML emitted by the Fountain library and does not strip or encode script-bearing markup. Because the generated HTML is injected into a document that is later rendered by the viewer webview (desktop/mobile) or published by Joplin Server, any script element, event handler attribute, or javascript: URI present in the generated output will be executed by the consuming browser context.

Two distinct execution contexts are described:

1. Client viewer context — When Fountain rendering is enabled in desktop or mobile clients, opening or previewing a note containing a crafted Fountain block executes script. The description notes the script "can read content subsequently loaded in the reused note viewer" — i.e., the webview is reused across notes, so injected script persists and can read notes loaded afterward.
2. Joplin Server origin context — When a note is published through Joplin Server, Fountain rendering is enabled by default. If published notes are served from the same domain as server content, the injected script runs in the server origin, granting access to "data available to an authenticated browser in the server origin."

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects: network-reachable delivery, low attack complexity, low privileges required, no user interaction, scope change (the vulnerable component impacts resources beyond its security scope), and high confidentiality impact only. Note the S:C scope-change component is central — the rendered script escapes the note-rendering context into the broader viewer or server origin.

Affected components (from description, verbatim): packages/renderer/MdToHtml/rules/fountain.ts, the vendored fountain.js renderer, Joplin desktop clients, Joplin mobile clients, Joplin Server published-note rendering.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-55105. The attack chain below is described at the vulnerability-class level, strictly limited to mechanisms stated in the NVD description.

1) Reconnaissance / target identification An attacker identifies a target using an affected Joplin version (< 3.6.15 or < 3.7.2). Relevant surfaces: desktop/mobile clients where the victim opens shared notes or synchronizes notes from a shared notebook, and Joplin Server instances that publish notes. For Joplin Server, the attacker needs to know that Fountain rendering is enabled by default on published notes.

2) Triggering the flaw class The attacker crafts a note containing a Fountain code block whose content causes the vendored fountain.js renderer to emit script-bearing HTML. Because packages/renderer/MdToHtml/rules/fountain.ts forwards that HTML into note output without sanitization, the payload survives into the rendered document. Triggering requires the note to be rendered with Fountain rendering enabled — true by default for published notes on Joplin Server, and configurable in desktop/mobile clients.

3) Delivery / execution Delivery is via a note the victim views or a published note served to a browser. In the client case, opening/previewing the note executes the script in the reused viewer. In the Joplin Server case, loading the published note executes the script in the server origin (assuming published notes share the domain with server content). No user interaction beyond note viewing/publishing is described (UI:N in the vector).

4) Post-exploitation impact

• Client viewer: the script reads note content subsequently loaded into the reused viewer — i.e., cross-note data exposure.
• Joplin Server origin: the script accesses data available to an authenticated browser session in the server origin — session-adjacent data exposure within that origin.

No code execution outside the browser/webview, no integrity impact, and no availability impact are described (consistent with I:N/A:N).

Impact Assessment

CVSS 3.1 base score 7.7 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N:

• AV:N (Network) — payload reaches victims over the network (shared notes, published notes).
• AC:L (Low) — no unusual conditions; default Fountain rendering on Joplin Server.
• PR:L (Low) — an attacker with a low-privileged account (e.g., ability to contribute/create a note that is rendered) suffices.
• UI:N (None) — no interaction beyond rendering is required per the vector.
• S:C (Changed) — the exploited component (note renderer) affects resources beyond its scope (viewer session, server origin).
• C:H — high confidentiality impact: cross-note content and authenticated server-origin data are exposed.
• I:N / A:N — no integrity or availability impact described.

Blast radius: Any deployment of Joplin desktop or mobile clients with Fountain rendering enabled, and any Joplin Server instance publishing notes where the published-note origin equals the server origin. High-value data at risk is note content itself and authenticated server-origin data. Because the viewer webview is reused, a single malicious note can expose notes viewed later in the same session. EPSS is not yet scored by FIRST.org; CISA KEV status is not listed.

Detection Guidance

Sigma Rule

title: Joplin Fountain Rendering XSS Attempt (CVE-2026-55105)
id: 8f3c2b91-6d47-4a10-9c2e-55105joplin
status: experimental
description: Detects rendering of Fountain code blocks containing script-bearing HTML in Joplin notes, indicative of CVE-2026-55105 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55105
author: valtersit.com
date: 2026/01/01
logsource:
  product: joplin
  category: application
detection:
  selection_lang:
    - 'fountain'
    - 'fountain.js'
  selection_payload:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
    - 'onclick='
  condition: selection_lang and selection_payload
fields:
  - note_id
  - user
  - source_ip
falsepositives:
  - Legitimate documentation notes describing XSS payloads
level: high
tags:
  - attack.t1204.001
  - cve.2026.55105

YARA Rule

rule CVE_2026_55105_Joplin_Fountain_XSS
{
    meta:
        description = "Detects Fountain code blocks embedding script-bearing HTML targeting Joplin fountain.ts renderer (CVE-2026-55105)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55105"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fountain = "fountain" nocase
        $script_open = "<script" nocase
        $script_close = "</script>" nocase
        $evt_onerror = "onerror=" nocase
        $evt_onload = "onload=" nocase
        $js_uri = "javascript:" nocase
        $img = "<img" nocase

    condition:
        $fountain and
        (1 of ($script_open, $js_uri)) or
        ($img and 1 of ($evt_onerror, $evt_onload))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55105 Joplin Fountain XSS - script in rendered note"; flow:established,to_client; http.header; content:"Joplin"; nocase; http.response_body; content:"<script"; nocase; content:"fountain"; nocase; distance:0; within:512; reference:cve,2026-55105; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55105; classtype:web-application-attack; sid:202655105; rev:1;)

Elastic Detection

sequence by user.name, host.name with maxspan=5m
  [ process where event.action == "start" and process.name : "joplin*" ]
  [ file where event.action in ("creation","modification") and
      file.extension in ("md","note") and
      wildcard(file.name, "*fountain*") and
      wildcard(file.path, "*renderer*") ]

Splunk SPL Query

index=joplin OR index=web
| search ("fountain" AND ("<script" OR "javascript:" OR "onerror=" OR "onload="))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources values(user) as users by note_id, host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="joplin,web,">
  <rule id="2026551" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.category">web</field>
    <field name="message">fountain</field>
    <match>script|javascript:|onerror=|onload=</match>
    <description>CVE-2026-55105: Possible Joplin Fountain rendering XSS exploitation attempt</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
    <group>cve_2026_55105,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description states the issue is fixed in 3.6.15 and 3.7.2, no vendor advisory, commit, or release artifact has been confirmed by the tracked patch sources.

1. Immediate mitigations

   • Disable Fountain rendering in Joplin desktop and mobile clients where configurable.
   • For Joplin Server, do not rely on default published-note rendering; disable or restrict Fountain rendering for published notes.
   • Isolate published-note serving onto a separate domain from the server origin to break the same-origin exposure path described in the NVD text.
   • Restrict who can create/synchronize notes into shared notebooks and published collections.
   • Treat note content from untrusted sources as hostile; do not preview untrusted notes in a session where sensitive notes are subsequently viewed (the reused viewer persists injected script).

2. Patch / upgrade steps

   • Verify vendor advisories directly before deploying; the CNA indicates fixes in 3.6.15 and 3.7.2, but no patch evidence is confirmed by tracked sources — validate signatures and release notes.
   • Upgrade desktop and mobile clients to the fixed releases and upgrade Joplin Server in lockstep.
   • After upgrade, re-audit published notes and shared notebooks for embedded Fountain blocks.

3. Long-term hardening

   • Enforce HTML sanitization on all renderer outputs (defense-in-depth for the fountain.ts path and any other vendored renderer).
   • Apply a strict Content-Security-Policy to viewer webviews and Joplin Server responses to block inline script execution.
   • Separate origins for user-generated content vs. authenticated application content across the deployment.
   • Track upstream issue trackers for a confirmed patch reference and update the patch confidence accordingly.

References

• NVD — CVE-2026-55105: https://nvd.nist.gov/vuln/detail/CVE-2026-55105
• Joplin project repository and release notes (verify versions 3.6.15 / 3.7.2): https://github.com/laurent22/joplin
• Joplin renderer path referenced by NVD: packages/renderer/MdToHtml/rules/fountain.ts (upstream source)
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-55105 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or known threat-actor campaign was identified in the provided data. EPSS has not yet scored this CVE.