~ / search / GHSA-q26w-wjj2-22vv

GHSA-q26w-wjj2-22vv

Cross-site scripting in Joplin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-28249

Packages

EcosystemPackageAffectedFixed in
npm joplin < 1.3.11 1.3.11

Details

As written in the advisory (Markdown source, shown as plain text).

Joplin allows XSS via a LINK element in a note.

References

External links from the advisory. They lead to third-party sites.