Skip to main content
cve.nowby Sazabi
← npm
npmPackage

joplin

14 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 2 high, 2 medium
Registry
npm

Advisories 14

  • Remote Code Execution on click of <a> Link in markdown preview

    Affected: from 3.0.0, fixed in 3.1.0.

  • Joplin before 2.11.5 allows XSS via an AREA element of an image map.

    Affected: fixed in 2.11.5.

  • Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

    Affected: fixed in 2.11.5.

  • CVE-2022-45598Medium 6.1

    Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

    Affected: fixed in 2.9.17.

  • Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious…

    Affected: through 2.8.8.

  • Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

    Affected: fixed in 2.9.1.

  • Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper…

    Affected: fixed in 1.8.5.

  • Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

    Affected: fixed in 2.7.1.

  • CVE-2021-23431Medium 5.4

    Cross-site Request Forgery (CSRF)

    Affected: fixed in 2.3.2.

  • Joplin before 2.0.9 allows XSS via button and form in the note body.

    Affected: fixed in 2.0.9.

  • Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

    Affected: fixed in 1.3.11.

  • An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

    Affected: from 1.0.190, fixed in 1.1.7.

  • Joplin through 1.0.184 allows Arbitrary File Read via XSS.

    Affected: fixed in 1.2.1.

  • Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular…

    Affected: fixed in 1.0.90.