# CVE-2020-28249: Joplin cross-site scripting via LINK element

Source: https://junglewise.ai/threats/cve-2020-28249-joplin-cross-site-scripting-via-link-element  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-28249 · Severity: low · CVSS 3.1 · Published 2021-05-10

Joplin is a popular open-source note-taking application that allows users to create and organize notes across multiple devices. An attacker can inject malicious JavaScript code into a note by embedding it within a LINK HTML element, which is then executed when the note is rendered, potentially allowing the attacker to steal user data or impersonate the user within the application.

Technologies: [joplin (npm)](https://junglewise.ai/threats/technologies/npm-joplin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-28249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28249 being exploited in the wild.

**How severe is CVE-2020-28249?** Low severity, with a CVSS score of 3.1, published 10 May 2021.

**Which products and versions are affected?** joplin (npm) SEMVER:introduced=0,fixed=1.3.11.

**Is there a fix for CVE-2020-28249?** Yes. joplin (npm): upgrade to 1.3.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28249 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-28249?** Check whether you run joplin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joplin (npm): upgrade to 1.3.11 or later

  ```sh
  npm install joplin@1.3.11
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) caused by insufficient sanitization of HTML tags in note content. Specifically, the LINK and META tags are not properly filtered before rendering notes in the user interface. An attacker can craft a malicious note containing a LINK tag with JavaScript code (e.g., via event handlers or href attributes pointing to javascript: URIs), and when any user views that note, the script executes in their browser context with their privileges. The attack requires user interaction (opening/viewing the note) but no authentication bypass. The fix, released in version 1.3.11, removes LINK and META tags from note HTML during rendering to prevent XSS.

## Affected products

- Joplin Project Joplin all versions before 1.3.11

## Identifiers

- CVE-2020-28249
- GHSA-q26w-wjj2-22vv

## Timeline

- 2020-11-06: disclosed
- 2021-05-10: patched: fix released in Joplin 1.3.11

## References

- [https://github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13](https://github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13)

## Related threats

- [Joplin Desktop remote code execution in markdown preview links](https://junglewise.ai/threats/cve-2024-49362-joplin-desktop-remote-code-execution-in-markdown-preview-links)
- [Joplin Cross-site Scripting in HTML area tag](https://junglewise.ai/threats/cve-2023-37299-joplin-cross-site-scripting-in-html-area-tag)
- [Joplin Desktop App cross-site scripting](https://junglewise.ai/threats/cve-2022-45598-joplin-desktop-app-cross-site-scripting)
- [Joplin Desktop cross-site scripting via NOSCRIPT tags](https://junglewise.ai/threats/cve-2021-33295-joplin-desktop-cross-site-scripting-via-noscript-tags)