# CVE-2020-15930: Joplin cross-site scripting in HTML embed tag

Source: https://junglewise.ai/threats/cve-2020-15930-joplin-cross-site-scripting-in-html-embed-tag  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-15930 · Severity: low · CVSS 3.1 · Published 2021-05-07

Joplin is a note-taking application for managing personal and business documents. An attacker can craft a malicious HTML embed tag in a note that, when opened by a user, allows arbitrary code execution on the victim's system, potentially compromising all stored notes and data.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2020-15930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15930 being exploited in the wild.

**How severe is CVE-2020-15930?** Low severity, with a CVSS score of 3.1, published 7 May 2021.

**Which products and versions are affected?** Joplin 1.0.190 to 1.1.6.

**Is there a fix for CVE-2020-15930?** A patch was published on 2021-05-07: Advisory published; fix available in version 1.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-15930 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-15930?** Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw classified as CWE-79 in Joplin's desktop application. The vulnerable component improperly sanitizes HTML embed tags in note content, allowing arbitrary code injection. Attack requires user interaction (opening a malicious note), but no authentication is needed beyond the user having access to Joplin. An attacker can execute arbitrary JavaScript code in the context of the Joplin application, potentially leading to code execution on the victim's system. The vulnerability was fixed in version 1.1.7, with the affected range being 1.0.190 through 1.1.6.

## Affected products

- Joplin Joplin 1.0.190 to 1.1.6

## Identifiers

- CVE-2020-15930
- GHSA-cgc7-mwp4-3ccx

## Timeline

- 2020-09-24: disclosed: Vulnerability published on NVD
- 2021-05-07: patched: Advisory published; fix available in version 1.1.7

## References

- [https://github.com/laurent22/joplin/issues/3552](https://github.com/laurent22/joplin/issues/3552)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin XSS vulnerability in HTML note links](https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin cross-site scripting in Fountain code blocks](https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in resource synchronization](https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin denial of service via uncontrolled resource allocation in note titles](https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in)