Description
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the shell.openExternal function.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.8.8
References
Could your website be exposed too?
SmartScanner can check your website for Joplin Remote Code Execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution leading to Remote Code Execution in superjson - CVE-2022-23631
- Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
- Joplin is vulnerable to arbitrary code execution - CVE-2022-35131
- Remote code execution in handlebars when compiling templates - CVE-2021-23369
You might also like:
See something that needs correcting? Let us knowUpdated April 23, 2024