← All advisories

Medium severity6.1NVD Advisory· Published Nov 6, 2020· Updated Jun 17, 2026

CVE-2020-28249

CVE-2020-28249

Description

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
joplinnpm	< 1.3.11	1.3.11

Affected products

3

Joplin Project/Joplin
cpe:2.3:a:joplin_project:joplin:1.2.6:*:*:*:*:*:*:*
Joplin/Joplin for Desktopdescription
ghsa-coords
pkg:npm/joplin
Range: < 1.3.11

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-q26w-wjj2-22vvghsaADVISORY
github.com/laurent22/joplin/releasesnvdThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2020-28249ghsaADVISORY
github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13ghsaWEB
github.com/laurent22/joplin/releases/tag/v1.3.11ghsaWEB
www.npmjs.com/package/joplinghsaWEB

News mentions

0

No linked articles in our index yet.