CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

Design/Logic Flaw

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

CVE-2022-35131 affects Joplin v2.8.8, enabling arbitrary command execution via a crafted payload injected into Node titles. The root cause is unsafe handling of user input in the UI, specifically unescaped input passed to dangerouslySetInnerHTML in GotoAnything.tsx. Several sources corroborate an...