CVE-2021-23431: Cross-site Request Forgery (CSRF) in joplin
Summary
CVE-2021-23431: Cross-site Request Forgery (CSRF) in joplin. Affects joplin versions < 2.3.2. Fixed in 2.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Joplin is an open-source note-taking and to-do application that allows users to create, organize, and synchronize their notes across multiple devices. It is written in JavaScript and uses the Electron framework. The vulnerability identified as CVE-2021-23431 is a Cross-site Request Forgery (CSRF) issue that affects versions of Joplin prior to 2.3.2. This vulnerability arises due to the absence of CSRF checks in various forms within the application.
Vulnerability Detail
The Cross-site Request Forgery (CSRF) vulnerability in Joplin allows an attacker to trick authenticated users into performing unintended actions on their behalf. By exploiting this vulnerability, an attacker can craft malicious requests that, when executed by a victim user, will perform actions on the Joplin application without their consent or knowledge. This can lead to unauthorized modifications, data leakage, or other malicious activities. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 3.7.1 as of 23 Oct 2026
npm install joplin@3.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.2
This is the first release that contains the fix.
npm install joplin@2.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or block any suspicious or unknown requests originating from the Joplin application. Additionally, users can employ browser extensions or plugins that provide CSRF protection to mitigate the risk of CSRF attacks. However, it is strongly advised to apply the official fix by upgrading to the latest version of Joplin as soon as possible.
Conclusion
The Cross-site Request Forgery (CSRF) vulnerability in Joplin can potentially lead to unauthorized actions and data manipulation. It is crucial for users of Joplin to upgrade to version 2.3.2 or later to mitigate the risk. Applying the official fix will ensure that the necessary CSRF checks are in place, preventing attackers from exploiting this vulnerability. For further support or assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for joplin →
FAQ
Cross-site Request Forgery (CSRF) is an attack that tricks the victim into performing unwanted actions on a web application in which they are authenticated.
The CSRF vulnerability in Joplin can lead to unauthorized modifications, data leakage, or other malicious activities performed on behalf of the victim user.
No, only versions of Joplin prior to 2.3.2 are vulnerable to this CSRF issue. It is recommended to upgrade to the latest version to mitigate the risk.
To update Joplin, follow the upgrade instructions provided by the Joplin project. These instructions can be found on the official Joplin website or in the project's documentation.
At the time of this advisory, there are no known public exploits specifically targeting this CSRF vulnerability in Joplin.
References
Related vulnerabilities
Recent vulnerabilities recorded for joplin.
