Joplin is vulnerable to arbitrary code execution · CVE-2022-35131 · GitHub Advisory Database · GitHub

Joplin is vulnerable to arbitrary code execution

Critical severity GitHub Reviewed Published Jul 26, 2022 to the GitHub Advisory Database • Updated Jan 30, 2023

Package

joplin (npm)

Affected versions

< 2.9.1

Patched versions

2.9.1

Description

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

References

Published by the National Vulnerability Database

Jul 25, 2022

Published to the GitHub Advisory Database Jul 26, 2022

Reviewed Jul 29, 2022

Last updated Jan 30, 2023

Severity

Critical

9.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H