CVE-2022-40277

published 2022-09-30

CVE-2022-40277: Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via…

Priority P3 42 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
joplinapp	joplin	—	—
joplinapp	joplin	0 – 2.8.8	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20