# CVE-2023-37299: Joplin Cross-site Scripting in HTML area tag

Source: https://junglewise.ai/threats/cve-2023-37299-joplin-cross-site-scripting-in-html-area-tag  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-37299 · Severity: low · CVSS 3.1 · Published 2023-06-30

Joplin is a popular privacy-focused note-taking application used across multiple platforms. A vulnerability in versions before 2.11.5 allows attackers to inject malicious JavaScript code through crafted notebook content using HTML area tags, potentially compromising user data or session security. This affects users who open notebooks from untrusted sources. The issue has been fixed in version 2.11.5 and later.

Technologies: [joplin (npm)](https://junglewise.ai/threats/technologies/npm-joplin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-37299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-37299 being exploited in the wild.

**How severe is CVE-2023-37299?** Low severity, with a CVSS score of 3.1, published 30 June 2023.

**Which products and versions are affected?** joplin (npm) SEMVER:introduced=0,fixed=2.11.5.

**Is there a fix for CVE-2023-37299?** Yes. joplin (npm): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-37299 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-37299?** Check whether you run joplin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joplin (npm): upgrade to 2.11.5 or later

  ```sh
  npm install joplin@2.11.5
  ```


## Technical details

The vulnerability is a Cross-site Scripting (CWE-79) flaw in Joplin's HTML rendering engine. The root cause is insufficient sanitization of HTML attributes, specifically within area elements that are part of image map markup. An attacker can create a malicious notebook with a crafted area tag containing XSS payload (e.g., in event handlers or javascript: URLs) that executes when the notebook is rendered. This requires the victim to open the malicious notebook, but no other authentication or network preconditions are needed. Successful exploitation allows arbitrary JavaScript execution in the context of the Joplin application, potentially enabling session hijacking, data theft, or further compromise. The fix was implemented in version 2.11.5 by sanitizing certain HTML attributes and disabling SVG tag support to prevent XSS vectors.

## Affected products

- Laurent22 Joplin < 2.11.5

## Identifiers

- CVE-2023-37299
- GHSA-4jjv-p8x9-rrf7

## Timeline

- 2023-06-30: disclosed
- 2023-05-28: patched: Version 2.11.5 released with fix

## References

- [https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071](https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071)
- [https://github.com/laurent22/joplin](https://github.com/laurent22/joplin)
- [https://github.com/laurent22/joplin/releases/tag/v2.11.5](https://github.com/laurent22/joplin/releases/tag/v2.11.5)
- [https://vuln.ryotak.net/advisories/68](https://vuln.ryotak.net/advisories/68)

## Related threats

- [Joplin Desktop remote code execution in markdown preview links](https://junglewise.ai/threats/cve-2024-49362-joplin-desktop-remote-code-execution-in-markdown-preview-links)
- [Joplin Desktop App cross-site scripting](https://junglewise.ai/threats/cve-2022-45598-joplin-desktop-app-cross-site-scripting)
- [Joplin Desktop cross-site scripting via NOSCRIPT tags](https://junglewise.ai/threats/cve-2021-33295-joplin-desktop-cross-site-scripting-via-noscript-tags)
- [Joplin cross-site scripting via LINK element](https://junglewise.ai/threats/cve-2020-28249-joplin-cross-site-scripting-via-link-element)