PT-2025-6012 · React+1 · React+1

Personalizedrefrigerator · Published 2025-02-07 · Updated 2025-02-08 · CVE-2025-25187

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.1.24

Description This issue is caused by Joplin adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive script-src, allowing arbitrary JavaScript execution via inline onclick/onload event handlers in unsanitized HTML. Additionally, Joplin's main window is created with nodeIntegration set to true, allowing arbitrary JavaScript execution to result in arbitrary code execution. Users who receive notes from unknown sources and use the search function are impacted.

Recommendations For versions prior to 3.1.24, upgrade to version 3.1.24 or later to resolve the issue. As a temporary workaround, consider avoiding the use of notes from unknown sources and refraining from using the search function until the upgrade is applied. Restrict access to the dangerouslySetInnerHTML function and ensure proper escaping of HTML entities to minimize the risk of exploitation. Avoid using the nodeIntegration feature with true setting until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25187

GHSA-9GFV-Q6WJ-FR3C

Affected Products

Joplin

React

References · 10

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-9gfv-q6wj-fr3c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25187.json · Exploit
• https://github.com/laurent22/joplin/commit/360ece6f8873ef81afbfb98b25faad696ffccdb6 · Patch
• https://osv.dev/vulnerability/CVE-2025-25187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25187 · Security Note
• https://github.com/laurent22/joplin/blob/2fc9bd476b0d9abcddb0a46f615a48333779d225/packages/app-desktop/plugins/GotoAnything.tsx#L558 · Note
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src · Note
• https://twitter.com/CVEnew/status/1887997369175691480 · Twitter Post
• https://t.me/cvedetector/17531 · Telegram Post
• https://twitter.com/cybercronai/status/1888328289925640696 · Twitter Post