Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for int…