← All advisories

Critical severity9.0NVD Advisory· Published Jul 25, 2022· Updated Jul 9, 2026

CVE-2022-35131

CVE-2022-35131

Description

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
joplinnpm	< 2.9.1	2.9.1

Affected products

3

Joplin/Joplin2 versions
cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:-:*:*+ 1 more
- cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:-:*:*
- (no CPE)
ghsa-coords
pkg:npm/joplin
Range: < 2.9.1

Patches

Vulnerability mechanics

References

5

github.com/advisories/GHSA-ww2v-frv5-pj5xghsaADVISORY
github.com/laurent22/joplin/releases/tag/v2.9.1nvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-35131ghsaADVISORY
joplin.comghsaWEB
github.com/laurent22/joplin/commit/e797ebb864fbf429a49b6d20e5779d0c9aa6c4d5ghsaWEB

News mentions

0

No linked articles in our index yet.