Executive brief
Joplin is a popular note-taking application that allows users to create and organize notes in markdown format. A vulnerability in version 2.8.8 allows an attacker to execute arbitrary commands on a user's computer by embedding malicious links in markdown files. When a user opens such a file in Joplin and clicks on the link, the attacker gains the ability to run any command with the user's privileges, potentially compromising the entire system.
Technical details
This vulnerability is a command injection flaw (CWE-20: Improper Input Validation) in how Joplin processes links in markdown files. The application fails to properly validate the URI scheme/protocol of links before passing them to the shell.openExternal() function, which executes them at the OS level. An attacker can craft a markdown file with a malicious link using custom URI schemes that execute shell commands when clicked. The attack requires user interaction (clicking the link) but no authentication. The vulnerability affects Joplin version 2.8.8 and earlier versions. Patch information should be verified from the official Joplin repository.
Affected products
- Joplin Joplin up to 2.8.8
Timeline
- 2022-10-01: disclosed
- 2022-09-30: other: NVD published