Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-40277

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible b

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fluid Attacks

Description

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Joplin

  • 2.8.8affected

References