Joplin is vulnerable to arbitrary code execution

Description

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

Recommendation

Update the joplin package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.9.1
• Patched version(s): 2.9.1

References

• GHSA-ww2v-frv5-pj5x
• joplin.com
• CVE-2022-35131
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
• Potential DoS when using ContextLines integration - Vulnerability
• sanitize-html Information Exposure vulnerability - CVE-2024-21501

Tags:

npm

joplin