Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

Description

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

Recommendation

Update the joplin package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.8.5
• Patched version(s): 1.8.5

References

• GHSA-phj8-2p6x-hq5r
• the-it-wonders.blogspot.com
• CVE-2021-33295
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• Joplin vulnerable to Cross-site Scripting in notes - CVE-2021-37916
• Margox Braft-Editor Cross-site Scripting Vulnerability - CVE-2021-27524
• Joplin Cross-site Scripting vulnerability - CVE-2023-37299

Tags:

npm

joplin