CVE-2026-49450 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin Desktop for Windows prior to version 3.7.2 represents a critical failure in software supply chain security, specifically within the application's automatic update mechanism. The core technical flaw stems from an omission of the publisherName field in the packages/app-desktop/package.json configuration file during the build process. This missing metadata prevents the generation of accurate signature verification parameters required by the NsisUpdater component. Consequently, when a user initiates or approves an update installation, the verifySignature() function fails to perform its intended security check: comparing the Authenticode digital signature of the downloaded installer against the known trusted publisher certificate associated with Joplin. This oversight effectively disables code signing validation for updates delivered through this specific pathway, allowing any entity capable of intercepting or controlling the update delivery channel to substitute legitimate software with malicious payloads without triggering a cryptographic mismatch error that would alert the user.
From an operational perspective, this vulnerability creates a severe risk of unauthorized code execution under the context of the currently logged-in user. An attacker who compromises the update server, performs a man-in-the-middle attack on the network connection during the download phase, or otherwise manipulates the distribution path can replace the legitimate installer with one signed by an arbitrary certificate or left entirely unsigned. Because the verification step is bypassed due to the missing publisher name configuration, the application accepts this modified binary as valid upon user approval of the installation prompt. This leads directly to the execution of attacker-controlled code with the same privileges as the end-user. The impact extends beyond simple privilege escalation; since Joplin stores sensitive information such as notes, credentials, and local data files, successful exploitation allows an adversary to exfiltrate this confidential information or modify it to facilitate further attacks within the user's environment.
This flaw aligns with CWE-347, which describes Improper Verification of Cryptographic Signature, a common weakness in systems that fail to validate digital signatures before executing code from external sources. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1195.002, Supply Chain Compromise: Compromise Software Supply Chain, where attackers manipulate software distribution channels to deliver malware. The specific method of bypassing signature verification also relates to CWE-863, which covers Incorrect Authorization checks that allow actions to proceed without proper validation. In the context of desktop applications using NSIS installers, this represents a significant deviation from secure coding practices that mandate strict certificate pinning or rigorous signature verification for all updates.
To mitigate this vulnerability and prevent similar issues in future releases, it is imperative to ensure that build configurations explicitly include all necessary metadata required by security validation modules. Specifically, the publisherName must be correctly populated in package.json so that NsisUpdater can accurately reference the trusted certificate during the update process. Developers should implement automated testing within their CI/CD pipelines to verify that signature checks are functioning as intended before releasing new versions. Additionally, users of affected systems should immediately upgrade to version 3.7.2 or later, where this configuration error has been corrected and proper Authenticode verification is enforced. Until the update occurs, administrators may consider restricting automatic updates for Joplin Desktop on Windows systems and manually verifying installer signatures against known good hashes if manual installation becomes necessary.