CVE-2023-38506highCWE-79

CVE-2023-38506: falha de alta gravidade em laurent22 joplin

Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar joplin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.4%
Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized (or not sanitized properly). As such, the `onload` attribute of pasted images can execute arbitrary code. Because the TinyMCE editor frame does not use the `sandbox` attribute, such scripts can access NodeJS's `require` through the `top` variable. From this, an attacker can run arbitrary commands. This issue has been addressed in version 2.12.10 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Produtos afetados
laurent22 · joplin
CVEs relacionadas — laurent22 joplin

No mesmo produto, das mais perigosas para as menos.

CVE-2025-27134HIGHPrivilege escalation in Joplin server via user patch endpointEPSS 2.3%CVE-2024-49362HIGHRemote Code Execution on click of <a> Link in markdown previewEPSS 1.1%CVE-2023-45673HIGHArbitrary code execution on click of PDF links in JoplinEPSS 1.0%CVE-2024-40643CRITICALJoplin has a parsing error leading to Cross-site Scripting (XSS)EPSS 0.8%CVE-2024-53268HIGHLack of validation on openExternal allows 1 click remote code execution in joplinEPSS 0.8%CVE-2025-27409HIGHJoplin Server Vulnerable to Path TraversalEPSS 0.7%