{"cve":"CVE-2026-49450","nvd":{"published":"2026-09-21T21:17:03.747","modified":"2026-09-23T18:30:42.573","status":"Deferred","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.1},"cwes":["CWE-345","CWE-353","CWE-494"],"references":["https://github.com/laurent22/joplin/commit/853659edf575c4f526c2b196e0629462aee9df28","https://github.com/laurent22/joplin/pull/15539","https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273","https://github.com/laurent22/joplin/security/advisories/GHSA-9wp7-hr9m-3273"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-49450","score":0.00182,"percentile":0.07765,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}