Executive brief
Joplin is a popular open-source note-taking and task management application. A vulnerability in versions before 2.7.1 allows attackers to inject malicious code into search results that executes arbitrary system commands when a user searches, potentially compromising the user's computer and all local data stored in the application.
Technical details
Joplin is vulnerable to code injection (CWE-94) in its search functionality. When a user performs a search via Ctrl+P, malicious HTML/JavaScript payloads embedded in note content are rendered without proper sanitization, allowing arbitrary code execution in the Electron context. The attack requires no authentication or user interaction beyond normal search usage. An attacker can execute system commands (e.g., `calc.exe` on Windows) by crafting a note containing an img tag with onerror handler that calls `require('child_process').exec()`. The vulnerability was fixed in version 2.7.1.
Affected products
- Joplin Joplin before 2.7.1
Timeline
- 2022-01-11: disclosed: Vulnerability reported on GitHub
- 2022-02-09: disclosed: GHSA advisory published
- 2022-02-09: patched: Fixed in version 2.7.1