CVE-2022-35131

CVE-2022-35131 describes a cross-site scripting (XSS) vulnerability in Joplin version 2.8.8 and earlier, leading to remote code execution (RCE). The root cause is the use of dangerouslySetInnerHTML in the GotoAnything dialog component (GotoAnything.tsx), which renders user-provided note titles without proper HTML escaping [3][4]. The surroundKeywords function, designed to highlight search terms, failed to sanitize user input, allowing arbitrary JavaScript to be injected into the DOM [3].

An attacker can exploit this by creating a note with a JavaScript payload embedded in the title. When the victim uses the GotoAnything dialog (Ctrl+P) and searches for a term that matches the payload, the title is rendered as unescaped HTML [4]. The payload executes in the context of the Electron application, which has access to Node.js APIs. The attacker does not require authentication; sharing a notebook with a malicious note title is sufficient to trigger the vulnerability when the recipient searches notes [4].

Successful exploitation gives the attacker arbitrary code execution on the victim's system. Proof-of-concept payloads demonstrate launching calculator applications on both Windows and Linux, as well as establishing reverse shells [4]. The impact is severe because Joplin is used for note-taking and synchronization across multiple devices, and the vulnerability can spread via shared notebooks.

The issue was reported and fixed in June 2022 [4]. The commit e797ebb864fbf429a49b6d20e5779d0c9aa6c4d5 implements input escaping in the surroundKeywords function, mitigating the XSS [3]. Users should update to a patched version (2.9.0 or later). There is no evidence of exploitation in the wild, but the vulnerability is critical due to its high CVSS score and public proof-of-concept code.