GHSA-phj8-2p6x-hq5r

Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33295

Packages

Ecosystem	Package	Affected	Fixed in
npm	joplin	< 1.8.5	1.8.5

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33295 advisory
https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf web
https://github.com/laurent22/joplin package
https://github.com/laurent22/joplin/releases/tag/v1.8.5 web
https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.html web