CVE-2026-105784 | CVSS: 4.6 | 严重级别: MEDIUM
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements a
参考链接:
• https://github.com/laurent22/joplin/commit/7fb9ec93e47cec39a548a76e03d7ad660ca0f
• https://github.com/laurent22/joplin/pull/16275
• https://github.com/laurent22/joplin/releases/tag/v3.7.13
📌 数据来源: NVD 官方