Executive brief
Joplin is a note-taking and task management application used to organize and store personal and work information. An attacker can execute arbitrary commands on a user's system by crafting a malicious payload in a note title, which the application processes unsafely. This could allow an attacker to compromise the user's system, steal sensitive data from notes and files, or use the compromised system for further attacks.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the GotoAnything dialog component that fails to properly sanitize user input in node titles before rendering. An attacker can inject malicious code into note titles that, when processed by the application, executes arbitrary commands. The attack requires user interaction (the victim must use the GotoAnything dialog to trigger the payload) and affects Joplin versions prior to 2.9.1. The fix involves proper HTML entity encoding in the string-utils.js component to prevent code injection.
Affected products
- Joplin Joplin before 2.9.1
Timeline
- 2022-07-26: disclosed
- 2022-07-29: patched: Fixed in version 2.9.1