Joplin Project Security Vulnerabilities

CVE-2023-37299

Joplin before 2.11.5 allows XSS via an AREA element of an image...

CVE-2023-37298

Joplin before 2.11.5 allows XSS via a USE element in an SVG...

CVE-2022-45598

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper...

CVE-2021-33295

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of...

CVE-2022-23340

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search...

CVE-2021-37916

Joplin before 2.0.9 allows XSS via button and form in the note...

CVE-2020-28249

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a...

CVE-2020-15930

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed...

CVE-2020-9038

Joplin through 1.0.184 allows Arbitrary File Read via...

CVE-2018-1000534

Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here...