High severity7.8NVD Advisory· Published Sep 30, 2022· Updated Jun 17, 2026
CVE-2022-40277
CVE-2022-40277
Description
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
joplinnpm | <= 2.8.8 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- fluidattacks.com/advisories/skrillex/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-mjr5-v9c9-mm7gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-40277ghsaADVISORY
- fluidattacks.com/advisories/skrillexghsaWEB
News mentions
0No linked articles in our index yet.