Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a link within untrusted notes. The issue arises due to insufficient sanitization of <a tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution. Details In the markdown preview iframe, Joplin only opens <a links internally within the same Electron window if they contain the data-from-md attribute. While Joplin successfully sanitizes the data-from-md attribute in user-embedded <a links from the .md file to prevent the execution of untrusted HTML content, it fails to sanitize the data-from-md attributes of <a tags introduced by Mermaid (e.g., the code snippet shown below). Since Mermaid allows the rendering of certain scriptless HTML elements, an attacker can embed <a tags with data-from-md attributes, which…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
Recommended action: Upgrade to 2.11.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
Recommended action: Upgrade to 2.11.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
Recommended action: Upgrade to 2.9.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Recommended action: Upgrade to 2.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
Recommended action: Upgrade to 1.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.
Recommended action: Upgrade to 2.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin version prior to 1.0.90 contains a Cross-site Scripting (XSS) evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 that can result in executing unauthorized code within the rights in which the application is running. This attack appear to be exploitable via Victim synchronizing notes from the cloud services or other note-keeping services which contain malicious code. This vulnerability appears to have been fixed in 1.0.90 and later.
Recommended action: Upgrade to 1.0.90 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results.
Recommended action: Upgrade to 2.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
Recommended action: Upgrade to 2.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 1.3.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).
Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.