Description
Joplin before 2.0.9 allows XSS via button and form in the note body.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | joplin | < 2.0.9 | 2.0.9 | GHSA-mrmf-755g-w2vw |
Medium · 6.1
CVE-2021-37916
EUVD-2022-4621GHSA-mrmf-755g-w2vw
Joplin vulnerable to Cross-site Scripting in notes
Published Aug 2, 2021 · Updated Aug 4, 2024 · Assigned by mitre