Description

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

Remediation

References

http://joplin.com

https://github.com/ly1g3/Joplin-CVE-2022-35131

https://github.com/laurent22/joplin/releases/tag/v2.9.1

Related Vulnerabilities

CVE-2020-12265 Vulnerability in maven package org.webjars:decompress

CVE-2022-25918 Vulnerability in npm package shescape

CVE-2022-37266 Vulnerability in npm package steal

CVE-2018-3721 Vulnerability in npm package @sailshq/lodash

CVE-2017-16216 Vulnerability in npm package tencent-server

Severity

Critical

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory Release Notes