Executive brief
Joplin is a popular open-source note-taking application that syncs across devices and cloud services. Versions before 1.0.90 contain a cross-site scripting vulnerability in note content that can lead to arbitrary code execution when notes with malicious content are synchronized from cloud services. An attacker can exploit this by crafting notes with XSS payloads that execute with the application's privileges when a user syncs or opens the malicious content.
Technical details
This vulnerability is a cross-site scripting (XSS) issue (CWE-79) affecting Joplin's note content rendering. The root cause is that the BrowserWindow instance had nodeIntegration enabled, allowing XSS payloads in note content to evolve into arbitrary code execution. The attack vector requires user interaction—specifically, the victim must synchronize notes from cloud services or other note-keeping services containing malicious code. An attacker can achieve remote code execution with the privileges of the running application. The vulnerability was fixed in version 1.0.90 as evidenced by commit 494e235e18659574f836f84fcf9f4d4fcdcfcf89.
Affected products
- Joplin Joplin before 1.0.90
Timeline
- 2018-06-26: disclosed
- 2018: patched: Fixed in version 1.0.90
- 2022-05-14: advisory