Executive brief
Joplin is a popular note-taking application for desktop that allows users to view and edit markdown documents. A vulnerability in the markdown preview feature allows attackers to execute arbitrary shell commands when a user clicks on a malicious link embedded in an untrusted note, compromising the user's entire system with the privileges of the application.
Technical details
The vulnerability is a code execution flaw stemming from insufficient sanitization of HTML anchor tags introduced by the Mermaid diagram library in markdown previews. Joplin uses the `data-from-md` attribute to distinguish internally-safe links from external ones, but fails to sanitize this attribute when Mermaid renders diagram elements. An attacker can inject `<a>` tags with crafted `data-from-md` attributes and `href` attributes pointing to local HTML files. Since the preview iframe lacks sandbox isolation and shares the same origin as the parent Electron window (which has `nodeIntegration: true` and `contextIsolation: false`), scripts in the referenced HTML file can access Node.js APIs via `window.parent.require()` and execute arbitrary system commands. The attack requires the victim to have a malicious HTML file locally accessible and to click the crafted link in an untrusted note.
Affected products
- Joplin Desktop 3.0.0 before 3.1.0
Timeline
- 2024-11-14: disclosed
- 2024-11-14: patched: Fix available in version 3.1.0