PT-2025-6010 · Joplin · Joplin

Personalizedrefrigerator · Published 2025-02-07 · Updated 2025-02-08 · CVE-2025-24028

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.2.12

Description This issue is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments, affecting both the Rich Text Editor and the Markdown viewer. However, the Markdown viewer is cross-origin isolated, preventing JavaScript from directly accessing functions or variables in the toplevel Joplin window. This is an XSS vulnerability that impacts users who open untrusted notes in the Rich Text Editor.

Recommendations For Joplin versions prior to 3.2.12, upgrade to version 3.2.12 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Rich Text Editor for untrusted notes until the update is applied. Restrict access to untrusted notes in the Rich Text Editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24028

GHSA-5W3C-WPH9-HQ92

Affected Products

Joplin

References · 10

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24028.json · Exploit
• https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e · Patch
• https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-24028 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24028 · Vendor Advisory
• https://t.me/cvedetector/17530 · Telegram Post
• https://twitter.com/CVEnew/status/1887995121603428490 · Twitter Post
• https://twitter.com/cybercronai/status/1888347449036615969 · Twitter Post
• https://joplinapp.org/help/dev/spec/note_viewer_isolation · Note