Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

Description

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

Recommendation

Update the joplin package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.8.5
• Patched version(s): 1.8.5

References

• GHSA-phj8-2p6x-hq5r
• the-it-wonders.blogspot.com
• CVE-2021-33295
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• textAngular Cross-site Scripting vulnerability - CVE-2021-32854
• Joplin vulnerable to Cross-site Scripting in notes - CVE-2021-37916
• Vditor Cross-site Scripting vulnerability - CVE-2021-32855
• Joplin Cross-site Scripting vulnerability (GHSA-7grw-xfx6-qhx6) - CVE-2023-37298

Tags:

npm

joplin