# CVE-2024-49362: Joplin Desktop remote code execution in markdown preview links

Source: https://junglewise.ai/threats/cve-2024-49362-joplin-desktop-remote-code-execution-in-markdown-preview-links  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-49362 · Severity: low · CVSS 3.1 · Published 2024-11-14

Joplin is a popular note-taking application for desktop that allows users to view and edit markdown documents. A vulnerability in the markdown preview feature allows attackers to execute arbitrary shell commands when a user clicks on a malicious link embedded in an untrusted note, compromising the user's entire system with the privileges of the application.

Technologies: [joplin (npm)](https://junglewise.ai/threats/technologies/npm-joplin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-49362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-49362 being exploited in the wild.

**How severe is CVE-2024-49362?** Low severity, with a CVSS score of 3.1, published 14 November 2024.

**Which products and versions are affected?** joplin (npm) SEMVER:introduced=3.0.0,fixed=3.1.0.

**Is there a fix for CVE-2024-49362?** Yes. joplin (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-49362 attacked?** It is attacked with local access.

**Am I affected by CVE-2024-49362?** Check whether you run joplin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joplin (npm): upgrade to 3.1.0 or later

  ```sh
  npm install joplin@3.1.0
  ```


## Technical details

The vulnerability is a code execution flaw stemming from insufficient sanitization of HTML anchor tags introduced by the Mermaid diagram library in markdown previews. Joplin uses the `data-from-md` attribute to distinguish internally-safe links from external ones, but fails to sanitize this attribute when Mermaid renders diagram elements. An attacker can inject `<a>` tags with crafted `data-from-md` attributes and `href` attributes pointing to local HTML files. Since the preview iframe lacks sandbox isolation and shares the same origin as the parent Electron window (which has `nodeIntegration: true` and `contextIsolation: false`), scripts in the referenced HTML file can access Node.js APIs via `window.parent.require()` and execute arbitrary system commands. The attack requires the victim to have a malicious HTML file locally accessible and to click the crafted link in an untrusted note.

## Affected products

- Joplin Desktop 3.0.0 before 3.1.0

## Identifiers

- CVE-2024-49362
- GHSA-hff8-hjwv-j9q7

## Timeline

- 2024-11-14: disclosed
- 2024-11-14: patched: Fix available in version 3.1.0

## References

- [https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7](https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7)

## Related threats

- [Joplin Cross-site Scripting in HTML area tag](https://junglewise.ai/threats/cve-2023-37299-joplin-cross-site-scripting-in-html-area-tag)
- [Joplin Desktop App cross-site scripting](https://junglewise.ai/threats/cve-2022-45598-joplin-desktop-app-cross-site-scripting)
- [Joplin Desktop cross-site scripting via NOSCRIPT tags](https://junglewise.ai/threats/cve-2021-33295-joplin-desktop-cross-site-scripting-via-noscript-tags)
- [Joplin cross-site scripting via LINK element](https://junglewise.ai/threats/cve-2020-28249-joplin-cross-site-scripting-via-link-element)