CVE-2020-15930

CVE-2020-15930 describes an XSS flaw in Joplin Desktop 1.0.190–1.0.245 that enables arbitrary code execution via a malicious HTML embed tag. Public details indicate the renderer does not blacklist HTML embeds, potentially enabling ACE when child windows opened with window.open() have node integra...