~ / search / GHSA-mrmf-755g-w2vw

GHSA-mrmf-755g-w2vw

Joplin vulnerable to Cross-site Scripting in notes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-37916

Packages

EcosystemPackageAffectedFixed in
npm joplin < 2.0.9 2.0.9

Details

As written in the advisory (Markdown source, shown as plain text).

Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.

References

External links from the advisory. They lead to third-party sites.