medium5.4
CVE-2021-33295
Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags
Impact
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | joplin | < 1.8.5 | 1.8.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Joplin Project | Joplin | before 1.8.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf
- https://github.com/laurent22/joplin/releases/tag/v1.8.5
- https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.html
- https://github.com/advisories/GHSA-phj8-2p6x-hq5r
- https://nvd.nist.gov/vuln/detail/CVE-2021-33295