CVE-2023-38506highCWE-79

CVE-2023-38506: fallo de gravedad alta en laurent22 joplin

Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear joplin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 0.4%
Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized (or not sanitized properly). As such, the `onload` attribute of pasted images can execute arbitrary code. Because the TinyMCE editor frame does not use the `sandbox` attribute, such scripts can access NodeJS's `require` through the `top` variable. From this, an attacker can run arbitrary commands. This issue has been addressed in version 2.12.10 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Productos afectados
laurent22 · joplin
CVEs relacionadas — laurent22 joplin

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-27134HIGHPrivilege escalation in Joplin server via user patch endpointEPSS 2.3%CVE-2024-49362HIGHRemote Code Execution on click of <a> Link in markdown previewEPSS 1.1%CVE-2023-45673HIGHArbitrary code execution on click of PDF links in JoplinEPSS 1.0%CVE-2024-40643CRITICALJoplin has a parsing error leading to Cross-site Scripting (XSS)EPSS 0.8%CVE-2024-53268HIGHLack of validation on openExternal allows 1 click remote code execution in joplinEPSS 0.8%CVE-2025-27409HIGHJoplin Server Vulnerable to Path TraversalEPSS 0.7%