CVE-2022-23340: Joplin Vulnerable to Code Injection
Summary
CVE-2022-23340: Joplin Vulnerable to Code Injection. Affects joplin versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Joplin is an npm package that provides a note-taking and to-do application with synchronization capabilities. It allows users to create, organize, and manage their notes across multiple devices. However, prior to version 2.7.1, Joplin is susceptible to a code injection vulnerability.
Vulnerability Detail
The code injection vulnerability in Joplin allows remote attackers to execute system commands by injecting malicious code into user search results. This can lead to unauthorized access, data leakage, and potential compromise of the affected system. The vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Latest published version: 3.7.1 as of 23 Oct 2026
npm install joplin@3.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
npm install joplin@2.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Joplin prior to version 2.7.1 is vulnerable to code injection, which can allow remote attackers to execute system commands. To mitigate this vulnerability, it is crucial to update Joplin to version 2.7.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for joplin →
FAQ
This vulnerability allows remote attackers to execute system commands, potentially leading to unauthorized access, data leakage, and compromise of the affected system.
To protect your system, it is recommended to update Joplin to version 2.7.1 or later, as this version includes the necessary patches to mitigate the code injection vulnerability.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is crucial to update Joplin to the latest version to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely by attackers injecting malicious code into user search results.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for joplin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
