High
Joplin: Stored XSS via inline-served note attachment on published shares
Type: advisorySources: OSV
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59814
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:57 UTC · Revision 1
Source evidence
Joplin: Stored XSS via inline-served note attachment on published shares
core-osv · Original sourcePublished 21 Sept 2026, 21:13 UTC
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.
osv:CVE-2026-59814
Complete source record
{
"id": "0b7ede7e6896b171371abfac6a8aa07af38b1486f3c02c626d196e6a1df893f0",
"url": "https://osv.dev/vulnerability/CVE-2026-59814",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Joplin: Stored XSS via inline-served note attachment on published shares",
"summary": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.",
"evidence": "osv:CVE-2026-59814",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-59814",
"aliases": [
"CVE-2026-59814",
"GHSA-mx98-7h4g-6gmh"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/laurent22/joplin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2ab3b6e00a0645b3779225b236501703a9fdef7d"
},
{
"fixed": "920cd8f463bf9bbce9daa07581676123007118e5"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.7.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "920cd8f463bf9bbce9daa07581676123007118e5"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v3.7.6",
"v3.7.5",
"v3.7.4",
"android-v3.7.2",
"v3.7.3",
"android-v3.7.1",
"v3.7.2",
"plugin-generator-v3.7.2",
"plugin-generator-v3.7.1",
"server-v3.7.1",
"v3.7.1",
"v3.6.12",
"android-v3.6.17",
"v3.6.10",
"server-v3.6.1",
"android-v3.6.16",
"v3.6.9",
"v3.6.8",
"ios-v13.6.4",
"android-v3.6.15",
"v3.6.7",
"v3.6.6",
"ios-v13.6.3",
"android-v3.6.14",
"v3.6.5",
"v3.6.4",
"android-v3.6.13",
"v3.6.3",
"transcribe-v3.6.6",
"transcribe-v3.6.5",
"transcribe-v3.6.3",
"transcribe-v3.6.2",
"transcribe-v3.6.1",
"android-v3.6.12",
"v3.6.2",
"v3.6.1",
"ios-v13.5.2",
"android-v3.5.7",
"v3.5.10",
"android-v3.5.6",
"android-v3.5.5",
"android-v3.5.4",
"server-v3.5.2",
"android-v3.5.3",
"server-v3.5.1",
"ios-v13.5.1",
"v3.5.9",
"v3.5.7",
"v3.5.6",
"plugin-repo-cli-v3.5.3",
"cli-v3.5.1",
"v3.5.5",
"plugin-repo-cli-v3.5.1",
"plugin-generator-v3.5.1",
"v3.5.4",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"server-v3.4.4",
"server-v3.4.3",
"cli-v3.4.1",
"ios-v13.4.2",
"android-v3.4.5",
"v3.4.8",
"v3.4.7",
"v3.4.6",
"server-v3.4.2",
"ios-v13.4.1",
"android-v3.4.4",
"v3.4.5",
"android-v3.4.3",
"v3.4.4",
"transcribe-v3.4.9",
"transcribe-v3.4.8",
"transcribe-v3.4.7",
"transcribe-v3.4.6",
"transcribe-v3.4.5",
"transcribe-v3.4.1",
"v3.4.3",
"android-v3.4.1",
"v3.4.2",
"server-v3.4.1",
"v3.4.1",
"v3.3.12",
"v3.3.11",
"cli-v3.3.1",
"v3.3.9",
"ios-v13.3.7",
"ios-v13.3.6",
"android-v3.3.8",
"v3.3.8",
"ios-v13.3.5",
"android-v3.3.7",
"v3.3.7",
"ios-v13.1.5",
"ios-v13.1.4",
"android-v3.1.5",
"v3.1.18",
"v3.1.17",
"android-v3.1.4",
"v3.1.16",
"v3.1.15",
"v3.1.14",
"v3.1.13",
"v3.1.12",
"v3.1.11",
"v3.1.10",
"v3.1.9",
"v3.1.8",
"v3.1.7",
"android-v3.1.3",
"v3.1.6",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"clipper-3.1.1",
"ios-v13.1.3",
"ios-v13.1.2",
"android-v3.1.2",
"ios-v13.1.1",
"android-v3.1.1",
"v3.1.1",
"ios-v13.0.3",
"android-v3.0.5",
"v3.0.10",
"android-v3.0.4",
"ios-v13.0.2",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"android-v3.0.3",
"v3.0.4",
"ios-v13.0.1",
"android-v3.0.2",
"v3.0.3",
"android-v3.0.1",
"v3.0.2",
"v3.0.1",
"ios-v12.14.6",
"android-v2.14.9",
"v2.14.17",
"android-v2.14.8",
"v2.14.16",
"ios-v12.14.5",
"android-v2.14.7",
"v2.14.15",
"v2.14.14",
"ios-v12.14.4",
"android-v2.14.6",
"v2.14.13",
"android-v2.14.5",
"v2.14.12",
"android-v2.14.4",
"v2.14.11",
"v2.14.10",
"server-v2.14.2",
"v2.14.9",
"v2.14.8",
"v2.14.7",
"ios-v12.14.2",
"android-v2.14.3",
"v2.14.6",
"android-v2.14.2",
"v2.14.5",
"v2.14.4",
"v2.14.3",
"ios-v12.14.1",
"android-v2.14.1",
"v2.14.2",
"v2.14.1",
"server-v2.14.1",
"server-v2.13.5",
"ios-v12.13.7",
"ios-v12.13.6",
"android-v2.13.7",
"v2.13.6",
"server-v2.13.4",
"plugin-generator-v2.13.2",
"cli-v2.13.1",
"android-v2.13.6",
"v2.13.5",
"ios-v12.13.4",
"v2.13.4",
"android-v2.13.5",
"ios-v12.13.3",
"ios-v12.13.2",
"android-v2.13.4",
"android-v2.13.3",
"ios-v12.13.1",
"v2.13.3",
"server-v2.13.2",
"android-v2.13.2",
"android-v2.13.1",
"plugin-generator-v2.13.1",
"v2.13.2",
"server-v2.13.1",
"v2.13.1",
"android-v2.12.1",
"v2.12.11",
"v2.12.10",
"v2.12.9",
"v2.12.8",
"v2.12.7",
"v2.12.6",
"server-v2.12.1",
"v2.12.5",
"v2.12.4",
"v2.12.3",
"v2.12.2",
"v2.12.1",
"plugin-generator-v2.12.1",
"plugin-generator-v2.11.1",
"v2.11.11",
"v2.11.10",
"android-v2.11.26",
"server-v2.11.2",
"v2.11.9",
"v2.11.8",
"v2.11.7",
"android-v2.11.25",
"android-v2.11.24",
"android-v2.11.23",
"v2.11.6",
"ios-v12.11.3",
"v2.11.5",
"ios-v12.11.2",
"ios-v12.11.1",
"v2.11.4",
"v2.11.3",
"server-v2.11.1",
"android-v2.11.22",
"android-v2.11.16",
"android-v2.11.14",
"v2.11.2",
"android-v2.11.13",
"android-v2.11.11",
"android-v2.11.10",
"android-v2.11.8",
"android-v2.11.7",
"android-v2.11.6",
"android-v2.11.4",
"android-v2.11.2",
"android-v2.11.1",
"clipper-2.11.2",
"v2.11.1",
"server-v2.10.11",
"server-v2.10.10",
"android-v2.10.8",
"cli-v2.10.3",
"cli-v2.10.2",
"v2.10.8",
"v2.10.7",
"android-v2.10.7",
"v2.10.6",
"android-v2.10.6",
"server-v2.10.9",
"server-v2.10.8",
"server-v2.10.7",
"server-v2.10.6",
"android-v2.10.5",
"ios-v12.10.2",
"v2.10.5",
"android-v2.10.4",
"android-v2.10.3",
"v2.10.4",
"android-v2.10.2",
"v2.10.3",
"android-v2.10.1",
"ios-v12.10.1",
"server-v2.10.5",
"android-v2.9.8",
"server-v2.9.7",
"server-v2.9.6",
"v2.9.12",
"android-v2.9.7",
"android-v2.9.6",
"v2.9.11",
"v2.9.10",
"v2.9.9",
"cli-v2.9.1",
"android-v2.9.5",
"android-v2.9.4",
"server-v2.9.5",
"server-v2.9.4",
"server-v2.9.3",
"server-v2.9.2",
"android-v2.9.3",
"server-v2.9.1",
"v2.9.8",
"v2.9.7",
"v2.9.5",
"android-v2.9.2",
"v2.9.4",
"v2.9.3",
"android-v2.9.1",
"v2.9.2",
"v2.9.1",
"clipper-2.8.1",
"cli-v2.8.1",
"v2.8.8",
"v2.8.7",
"v2.8.6",
"v2.8.5",
"plugin-generator-v2.8.1",
"v2.8.4",
"v2.8.3",
"v2.8.2",
"v2.8.1",
"ios-v12.7.1",
"v2.7.12",
"android-v2.7.2",
"v2.7.11",
"android-v2.7.1",
"v2.7.10",
"v2.7.9",
"server-v2.7.4",
"v2.7.8",
"v2.7.7",
"v2.7.6",
"v2.7.5",
"v2.7.4",
"v2.7.3",
"v2.7.2",
"v2.7.1",
"server-v2.7.3",
"server-v2.7.2",
"server-v2.7.1",
"plugin-generator-v2.7.3",
"plugin-generator-v2.7.2",
"plugin-generator-v2.7.1",
"plugin-repo-cli-v2.6.9",
"android-v2.6.8",
"android-v2.6.6",
"v2.6.6",
"android-v2.6.5",
"v2.6.5",
"v2.6.4",
"v2.6.3",
"server-v2.6.14",
"android-v2.6.4",
"server-v2.6.13",
"server-v2.6.12",
"android-v2.6.3",
"v2.6.2",
"server-v2.6.11",
"server-v2.6.10",
"server-v2.6.9",
"server-v2.6.8",
"server-v2.6.7",
"server-v2.6.6",
"server-v2.6.5",
"server-v2.6.4",
"server-v2.6.3",
"server-v2.6.2",
"v2.6.1",
"server-v2.6.1",
"cli-v2.6.1",
"android-v2.6.1",
"v2.5.10",
"v2.5.9",
"android-v2.5.5",
"android-v2.5.4",
"v2.5.8",
"v2.5.7",
"android-v2.5.3",
"v2.5.6",
"android-v2.5.2",
"v2.5.5",
"server-v2.5.9",
"server-v2.5.8",
"server-v2.5.7",
"server-v2.5.6",
"server-v2.5.5",
"server-v2.5.4",
"server-v2.5.3",
"v2.5.4",
"v2.5.3",
"server-v2.5.2",
"v2.5.1",
"server-v2.5.1",
"server-v2.4.11-beta",
"server-v2.4.10-beta",
"android-v2.4.2",
"server-v2.4.9-beta",
"v2.4.8",
"v2.4.7",
"server-v2.4.8-beta",
"server-v2.4.7-beta",
"server-v2.4.6-beta",
"server-v2.4.5-beta",
"server-v2.4.4-beta",
"v2.4.6",
"v2.4.5",
"server-v2.4.3-beta",
"server-v2.4.2",
"v2.4.3",
"v2.4.2",
"server-v2.3.1-beta",
"android-v2.2.3",
"android-v2.2.2",
"v2.2.6",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"server-v2.2.11-beta",
"server-v2.2.10",
"server-v2.2.9-beta",
"server-v2.2.7-beta",
"server-v2.2.6-beta",
"server-v2.2.5-beta",
"server-v2.2.4-beta",
"server-v2.2.3-beta",
"server-v2.2.2-beta",
"server-v2.2.1-beta",
"server-v2.1.6-beta",
"server-v2.1.5-beta",
"server-v2.1.4-beta",
"v2.1.5",
"v2.1.4",
"android-v2.1.2",
"android-v2.1.1",
"server-v2.1.3-beta",
"v2.1.1",
"server-v2.1.2-beta",
"server-v2.1.1",
"server-v2.0.14",
"cli-v2.0.1",
"plugin-generator-v2.0.1",
"v2.0.11",
"server-v2.0.13",
"android-v2.0.4",
"android-v2.0.3",
"ios-v12.0.2",
"ios-v20.0.1",
"android-v2.0.2",
"v2.0.10",
"server-v2.0.12",
"server-v2.0.11",
"server-v2.0.10",
"v2.0.9",
"server-v2.0.9-beta",
"server-v2.0.8-beta",
"v2.0.8",
"v2.0.7",
"v2.0.6",
"v2.0.5",
"server-v2.0.6",
"server-v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.1",
"android-v1.8.4",
"v1.8.3",
"android-v1.8.3",
"v1.8.2",
"android-v1.8.2",
"android-v1.8.1",
"v1.8.1",
"v1.7.6",
"v1.7.5",
"server-v1.7.2",
"v1.7.4",
"plugin-generator-v1.7.3",
"plugin-generator-v1.7.2",
"plugin-generator-v1.7.1",
"cli-v1.6.3",
"cli-v1.6.2",
"ios-v10.6.2",
"cli-v1.6.1",
"android-v1.6.6",
"android-v1.6.5",
"v1.6.6",
"v1.6.5",
"plugin-generator-v1.6.11",
"v1.6.4",
"plugin-generator-v1.6.10",
"plugin-generator-v1.6.9",
"plugin-generator-v1.6.8",
"plugin-generator-v1.6.7",
"plugin-generator-v1.6.6",
"plugin-generator-v1.6.5",
"plugin-generator-v1.6.4",
"v1.6.2",
"plugin-generator-v1.6.3",
"server-v1.6.4",
"plugin-generator-v1.6.2",
"android-v1.6.4",
"android-v1.6.3",
"android-v1.6.2",
"v1.6.1",
"ios-v10.5.1",
"v1.5.11",
"android-v1.5.1",
"cli-v1.5.1",
"v1.5.10",
"v1.5.9",
"v1.5.8",
"v1.5.7",
"v1.5.6",
"v1.5.5",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"ios-v10.4.1",
"android-v1.4.11",
"v1.4.11",
"plugin-generator-v1.4.5",
"clipper-1.4.3",
"v1.4.8",
"v1.4.7",
"ios-v10.3.1",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"android-v1.3.13",
"android-v1.3.11",
"v1.3.15",
"v1.3.14",
"android-v1.3.10",
"clipper-1.3.1",
"v1.3.10",
"cli-v1.3.3",
"cli-v1.3.2",
"cli-v1.3.1",
"android-v1.3.9",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.5",
"v1.3.4",
"android-v1.3.7",
"v1.3.3",
"v1.3.2",
"v1.3.1",
"cli-v1.2.1",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.244",
"v1.0.242",
"v1.0.243",
"android-v1.0.340",
"android-v1.0.339-3",
"v1.0.239",
"v1.0.238",
"v1.0.235",
"android-v1.0.337",
"v1.0.234",
"v1.0.214",
"v1.0.213",
"v1.0.212",
"v1.0.211",
"v1.0.210",
"v1.0.209",
"v1.0.208",
"cli-v1.0.164",
"v1.0.207",
"v1.0.206",
"v1.0.200",
"cli-v1.0.163",
"ios-v10.0.47",
"android-v1.0.327",
"v1.0.199",
"android-v1.0.326",
"v1.0.198",
"cli-v1.0.162",
"v1.0.197",
"android-v1.0.325",
"v1.0.196",
"android-v1.0.324",
"android-v1.0.323",
"v1.0.195",
"v1.0.194",
"android-v1.0.322",
"android-v1.0.321",
"clipper-1.0.25",
"clipper-1.0.23",
"ios-v10.0.45",
"android-v1.0.320",
"v1.0.193",
"cli-v1.0.161",
"cli-v1.0.160",
"cli-v1.0.159",
"cli-v1.0.158",
"cli-v1.0.157",
"cli-v1.0.156",
"android-v1.0.319-rc1",
"v1.0.192",
"v1.0.191",
"v1.0.190",
"v1.0.189",
"v1.0.188",
"clipper-1.0.22",
"clipper-1.0.21",
"v1.0.187",
"v1.0.186",
"v1.0.185",
"clipper-1.0.20",
"ios-v10.0.44",
"android-v1.0.318",
"android-v1.0.317",
"cli-v1.0.155",
"v1.0.184",
"v1.0.183",
"v1.0.182",
"cli-v1.0.154",
"ios-v10.0.43",
"android-v1.0.316",
"v1.0.179",
"v1.0.178",
"android-v1.0.315",
"v1.0.177",
"android-v1.0.314",
"android-v1.0.313",
"v1.0.176",
"ios-v10.0.41",
"android-v1.0.312",
"v1.0.175",
"android-v1.0.311",
"ios-v10.0.40",
"v1.0.174",
"clipper-1.0.19",
"cli-v1.0.150",
"ios-v10.0.39",
"v1.0.172",
"android-v1.0.310",
"v1.0.171",
"android-v1.0.309",
"android-v1.0.308",
"v1.0.170",
"cli-v1.0.149",
"cli-v1.0.148",
"android-v1.0.307",
"v1.0.169",
"cli-v1.0.147",
"android-v1.0.306",
"v1.0.168",
"ios-v10.0.37",
"android-v1.0.305",
"v1.0.167",
"android-v1.0.304",
"v1.0.166",
"cli-v1.0.146",
"cli-v1.0.145",
"android-v1.0.303",
"android-v1.0.299",
"v1.0.165",
"v1.0.164",
"v1.0.163",
"android-v1.0.294",
"v1.0.162",
"cli-v1.0.141",
"android-v1.0.293",
"android-v1.0.292",
"android-v1.0.291",
"android-v1.0.290",
"android-v1.0.289",
"android-v1.0.284",
"android-v1.0.283",
"android-v1.0.281",
"v1.0.161",
"android-v1.0.279",
"android-v1.0.277",
"clipper-1.0.17",
"android-v1.0.276",
"ios-v10.0.35",
"android-v1.0.271",
"android-v1.0.269",
"v1.0.160",
"android-v1.0.261",
"v1.0.159",
"android-v1.0.260",
"cli-v1.0.139",
"v1.0.158",
"android-v1.0.255",
"android-v1.0.254",
"v1.0.157",
"v1.0.156",
"android-v1.0.253",
"v1.0.155",
"v1.0.154",
"cli-v1.0.137",
"cli-v1.0.136",
"v1.0.153",
"cli-v1.0.135",
"cli-v1.0.133",
"cli-v1.0.129",
"cli-v1.0.128",
"cli-v1.0.127",
"ios-v10.0.34",
"android-v1.0.252",
"v1.0.152",
"cli-v1.0.126",
"clipper-1.0.14",
"ios-v10.0.33",
"android-v1.0.251",
"v1.0.151",
"android-v1.0.248",
"v1.0.150",
"v1.0.149",
"ios-v10.0.31",
"android-v1.0.243",
"v1.0.143",
"v1.0.142",
"clipper-1.0.13",
"clipper-1.0.12",
"clipper-1.0.10",
"android-v1.0.242",
"cli-v1.0.124",
"android-v1.0.241",
"v1.0.140",
"android-v1.0.240",
"v1.0.139",
"v1.0.138",
"v1.0.137",
"v1.0.136",
"v1.0.135",
"v1.0.134",
"v1.0.133",
"ios-v10.0.30",
"v1.0.132",
"v1.0.131",
"android-v1.0.239",
"v1.0.130",
"v1.0.129",
"android-v1.0.238",
"v1.0.128",
"android-v1.0.237",
"v1.0.127",
"cli-v1.0.123",
"cli-v1.0.122",
"v1.0.126",
"ios-v10.0.29",
"v1.0.125",
"android-v1.0.236",
"android-v1.0.234",
"v1.0.123",
"android-v1.0.233",
"v1.0.120",
"cli-v1.0.120",
"android-v1.0.232",
"android-v1.0.225",
"android-v1.0.224",
"android-v1.0.201",
"android-v1.0.200",
"android-v1.0.181",
"clipper-1.0.8",
"android-v1.0.179",
"ios-v10.0.27",
"android-v1.0.178",
"v1.0.119",
"android-v1.0.177",
"v1.0.118",
"v1.0.117",
"cli-v1.0.118",
"android-v1.0.176",
"v1.0.116",
"v1.0.115",
"cli-v1.0.117",
"android-v1.0.175",
"v1.0.114",
"android-v1.0.151",
"android-v1.0.148",
"v1.0.113",
"android-v1.0.142",
"v1.0.112",
"android-v1.0.141",
"android-v1.0.140",
"android-v1.0.138",
"v1.0.111",
"android-v1.0.135",
"v1.0.110",
"cli-v1.0.115",
"clipper-1.0.7",
"android-v1.0.133",
"v1.0.109",
"v1.0.108",
"android-v1.0.132",
"v1.0.107",
"v1.0.106",
"cli-v1.0.114",
"android-v1.0.131",
"v1.0.105",
"cli-v1.0.113",
"cli-v1.0.110",
"cli-v1.0.109",
"android-v1.0.129",
"v1.0.104",
"v1.0.103",
"untagged-6ad6c38d382d9cf912e5",
"android-v1.0.128",
"v1.0.102",
"v1.0.101",
"cli-v1.0.108",
"android-v1.0.127",
"v1.0.100",
"v1.0.99",
"v1.0.98",
"v1.0.97",
"v1.0.96",
"v1.0.95",
"v1.0.94",
"ios-v10.0.22",
"v1.0.93",
"v1.0.92",
"android-v1.0.125",
"cli-v1.0.107",
"v1.0.91",
"android-v1.0.124",
"v1.0.90",
"android-v1.0.123",
"ios-v10.0.21",
"android-v1.0.122",
"v1.0.89",
"v1.0.88",
"v1.0.87",
"android-v1.0.120",
"v1.0.86",
"v1.0.85",
"v1.0.84",
"android-v1.0.119",
"android-v1.0.118",
"cli-v1.0.106",
"v1.0.83",
"v1.0.82",
"android-v1.0.116",
"v1.0.81",
"android-v1.0.115",
"android-v1.0.103",
"cli-v1.0.100",
"v1.0.70",
"v1.0.69",
"v1.0.68",
"android-v1.0.102",
"ios-v1.0.13",
"cli-v1.0.99",
"v1.0.67",
"android-v1.0.101",
"android-v1.0.100",
"v1.0.66",
"cli-v1.0.98",
"cli-v1.0.97",
"cli-v1.0.96",
"v1.0.64",
"android-v1.0.98",
"android-v1.0.97",
"v1.0.63",
"cli-v1.0.95",
"android-v1.0.95",
"v1.0.62",
"android-v1.0.94",
"android-v0.10.92",
"v0.10.61",
"android-v0.10.91",
"android-v0.10.90",
"android-v0.10.89",
"android-v0.10.88",
"cli-v0.10.93",
"android-v0.10.86",
"v0.10.60",
"v0.10.59",
"android-v0.10.85",
"v0.10.58",
"v0.10.57",
"android-v0.10.83",
"v0.10.56",
"v0.10.55",
"cli-v0.10.87",
"android-v0.10.71",
"v0.10.43",
"v0.10.42",
"cli-v0.10.86",
"android-v0.10.69",
"v0.10.41",
"ios-v0.10.6",
"v0.10.38",
"android-v0.10.65",
"v0.10.37",
"v0.10.36",
"android-v0.10.62",
"v0.10.35",
"v0.10.34",
"v0.10.33",
"v0.10.32",
"v0.10.31",
"android-v0.10.61",
"v0.10.30",
"v0.10.29",
"v0.10.28",
"v0.10.27",
"v0.10.26"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59814.json"
}
}
],
"modified": "2026-10-28T02:30:36.071700541Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59814.json",
"https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59814",
"https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5",
"https://github.com/laurent22/joplin/pull/15787"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59814.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59814",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503385,
"published_at": "2026-09-21T21:13:17.395+00:00"
}