Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
Description
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive script-src. This allows arbitrary JavaScript execution via inline onclick/onload event handlers in unsanitized HTML. Additionally, Joplin's main window is created with nodeIntegration set to true, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses ctrl-p to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-srcmitrex_refsource_MISC
- github.com/laurent22/joplin/blob/2fc9bd476b0d9abcddb0a46f615a48333779d225/packages/app-desktop/plugins/GotoAnything.tsxmitrex_refsource_MISC
- github.com/laurent22/joplin/commit/360ece6f8873ef81afbfb98b25faad696ffccdb6mitrex_refsource_MISC
- github.com/laurent22/joplin/security/advisories/GHSA-9gfv-q6wj-fr3cmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.