Skip to content
OpenAdvisories

Package · npm

joplin

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • High 7.7
    CVE-2024-49362

    Remote Code Execution on click of <a> Link in markdown preview

    Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> ta…

    laurent22 joplin joplin npm
  • Medium 6.1
    CVE-2023-37299

    Joplin Cross-site Scripting vulnerability

    Joplin before 2.11.5 allows XSS via an AREA element of an image map.

    joplin npm
  • Medium 6.1
    CVE-2023-37298

    Joplin Cross-site Scripting vulnerability

    Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

    joplin npm
  • Medium 6.1
    CVE-2022-45598

    Joplin Desktop App vulnerable to Cross-site Scripting

    Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

    joplin npm
  • High 7.8
    CVE-2022-40277

    Joplin Remote Code Execution

    Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existi…

    joplin npm
  • Critical 9.0
    CVE-2022-35131 Public exploit

    Joplin is vulnerable to arbitrary code execution

    Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

    joplin npm
  • Medium 5.4
    CVE-2021-33295

    Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

    Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

    joplin npm
  • Critical 9.8
    CVE-2022-23340

    Joplin Vulnerable to Code Injection

    Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

    joplin npm
  • Medium 5.4
    CVE-2021-23431

    Cross-site Request Forgery (CSRF)

    The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

    joplin npm
  • Medium 6.1
    CVE-2021-37916

    Joplin vulnerable to Cross-site Scripting in notes

    Joplin before 2.0.9 allows XSS via button and form in the note body.

    joplin npm
  • Medium 6.1
    CVE-2020-28249 Public exploit

    Cross-site scripting in Joplin

    Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

    joplin npm
  • Medium 6.1
    CVE-2020-15930 Public exploit

    Cross-site Scripting in Joplin

    An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

    joplin npm
  • Medium 5.4
    CVE-2020-9038 Public exploit

    Cross-site Scripting in Joplin

    Joplin through 1.0.184 allows Arbitrary File Read via XSS.

    joplin npm
  • Medium 6.1
    CVE-2018-1000534

    Joplin Vulnerable to Cross-site Scripting in Note Content

    Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here h…

    joplin npm