CVE-2026-105783 | CVSS: 8 | 严重级别: HIGH
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent A
参考链接:
• https://github.com/laurent22/joplin/commit/27ae5c0d404ee47ad24862cce917dda6eb293
• https://github.com/laurent22/joplin/pull/16276
• https://github.com/laurent22/joplin/releases/tag/v3.7.13
📌 数据来源: NVD 官方