GitHub Advisoryadvisory · npm

GHSA-mjr5-v9c9-mm7g Joplin Remote Code Execution

HIGH Published 2022-10-01 Modified 2024-04-23 Official page ↗
Aliases
CVE-2022-40277
Ecosystem
npm
Packages
joplin
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2024-04-23

Affected packages

• npm joplin: <= 2.8.8 (no fix yet)

Description

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the `shell.openExternal` function.

Related

Alias · CVE (1)

  • CVE-2022-40277 Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References