High severityNVD Advisory· Published Sep 30, 2022· Updated May 20, 2025
CVE-2022-40277
CVE-2022-40277
Description
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
joplinnpm | <= 2.8.8 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-mjr5-v9c9-mm7gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-40277ghsaADVISORY
- fluidattacks.com/advisories/skrillexghsaWEB
- fluidattacks.com/advisories/skrillex/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.