Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

published 2026-09-21 48 d ago modified 2026-09-23 46 d ago also EUVD-2026-84166

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

Patch / fix

links 2

github.com/laurent22/joplin@853659e commit
github.com/laurent22/joplin#15539 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 47 d ago (2026-09-22)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

laurent22 joplin

Classification

Weakness

CWE-345 Insufficient Verification of Data Authenticity
CWE-353 Missing Support for Integrity Check
CWE-494 Download of Code Without Integrity Check

References

Sources

CVE List CVE-2026-49450
NVD CVE-2026-49450

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary