CVE-2024-49362
published 2024-11-14CVE-2024-49362: Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user…
PriorityP352critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
1.04%
59.6th percentile
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joplin_project | joplin | < 3.1 | 3.1 |
| joplinapp | joplin | >= 3.0.0 < 3.1.0 | 3.1.0 |
| laurent22 | joplin | < 3.1 | 3.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Remote Code Execution on click of <a> Link in markdown preview
osv·2024-11-14
CVE-2024-49362 [HIGH] Remote Code Execution on click of <a> Link in markdown preview
Remote Code Execution on click of Link in markdown preview
### Summary
There is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `` link within untrusted notes. The issue arises due to insufficient sanitization of `` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
### Details
In the markdown preview iframe, `Joplin` only opens `` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `` links from the `.md` file to prevent the execution of unt
GHSA
Remote Code Execution on click of <a> Link in markdown preview
ghsa·2024-11-14
CVE-2024-49362 [HIGH] CWE-94 Remote Code Execution on click of <a> Link in markdown preview
Remote Code Execution on click of Link in markdown preview
### Summary
There is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `` link within untrusted notes. The issue arises due to insufficient sanitization of `` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
### Details
In the markdown preview iframe, `Joplin` only opens `` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `` links from the `.md` file to prevent the execution of unt
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-14
Published