Cross-site Scripting (XSS) Vulnerability in Joplin Affects Safe Mode

CVE-2023-37898

What is CVE-2023-37898?

A vulnerability exists in the Joplin note taking application that exploits Cross-site Scripting (XSS) due to improper rendering of note content in safe mode. When untrusted notes are opened in this mode, the application does not escape HTML tags, allowing an attacker to insert malicious code. The rendered Markdown iframe runs with the same origin as the top-level document, providing the potential for attackers to access critical NodeJS functions, such as require, which can facilitate the execution of arbitrary commands, including the import of sensitive modules. Users are strongly advised to upgrade to version 2.12.9, where this issue has been resolved.

References