Cross-site Scripting (XSS) Vulnerability in Joplin Affects Arbitrary Shell Commands Execution

CVE-2023-39517

What is CVE-2023-39517?

A Cross Site Scripting (XSS) vulnerability exists in the Joplin Note Taking Application allowing an attacker to execute arbitrary shell commands via untrusted image links. The vulnerability is due to the failure of the HTML sanitizer to adequately remove the target and href attributes from <map> and <area> elements, unlike proper sanitization of <a> links. Furthermore, because the note preview pane is not sandboxed to prevent top-level navigation, malicious links can replace the overarching Electron page. This replacement can grant access to sensitive functions, including the ability to call child_process and execute unauthorized shell commands. Users are strongly urged to upgrade to release version 2.12.8 or later to mitigate this risk as there are no known workarounds for this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References