~ / search / GHSA-ww2v-frv5-pj5x

GHSA-ww2v-frv5-pj5x

Joplin is vulnerable to arbitrary code execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-35131

Packages

EcosystemPackageAffectedFixed in
npm joplin < 2.9.1 2.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

References

External links from the advisory. They lead to third-party sites.