PT-2022-25315 · Joplin · Joplin

Carlos Bello · Published 2022-09-30 · Updated 2025-05-20 · CVE-2022-40277

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin version 2.8.8

Description The issue allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the shell.openExternal function.

Recommendations For Joplin version 2.8.8, consider disabling the shell.openExternal function until a patch is available to prevent remote code execution when opening malicious markdown files. Restrict access to markdown files from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-40277

GHSA-MJR5-V9C9-MM7G

Affected Products

Joplin

References · 8

• 🔥 https://fluidattacks.com/advisories/skrillex · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40277 · Security Note
• https://osv.dev/vulnerability/GHSA-mjr5-v9c9-mm7g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40277 · Vendor Advisory
• https://github.com/laurent22/joplin · Note
• https://twitter.com/sifu0nulls/status/1831767164262772830 · Twitter Post
• https://t.me/cibsecurity/50784 · Telegram Post
• https://t.me/cvenotify/123117 · Telegram Post