CVE-2024-49362: Joplin Remote Code Execution via Unsanitized Links in Markdown Preview
Summary
CVE-2024-49362: Remote Code Execution on click of Link in markdown preview. Affects joplin versions >= 3.0.0, < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Joplin is an open-source note-taking and to-do application that allows users to organize their notes in a structured manner. It supports markdown for formatting notes and integrates with various services for synchronization. Joplin's markdown preview feature enables users to view formatted notes, but it has a critical vulnerability that can lead to remote code execution when untrusted links are clicked.
Vulnerability Detail
The vulnerability in Joplin arises from insufficient sanitization of the 'data-from-md' attribute in <a> tags introduced by the Mermaid library. When a user clicks on such a link, it opens in the same Electron window, allowing the execution of untrusted HTML content. This is particularly dangerous because the Electron environment has full access to Node.js APIs, enabling attackers to execute arbitrary shell commands. The vulnerability is exacerbated by the fact that Joplin runs with 'nodeIntegration' set to true and 'contextIsolation' set to false, allowing scripts in the iframe to access Node.js APIs directly.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install joplin@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid clicking on any <a> links in untrusted markdown notes until they have updated to the patched version. Additionally, users can disable the markdown preview feature to prevent any potential exploitation.
Conclusion
CVE-2024-49362 represents a significant security risk for Joplin users, allowing remote code execution through untrusted markdown links. It is crucial for users to update to the latest version to protect against this vulnerability. For ongoing monitoring of open-source vulnerabilities, consider using Vulert, which can alert you in real-time without requiring code access.
See every vulnerability recorded for joplin →
FAQ
CVE-2024-49362 is a vulnerability in Joplin that allows remote code execution when a user clicks on untrusted links in markdown notes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the user's machine if they interact with malicious markdown content.
Yes, the vulnerability has been patched in Joplin version 3.1. Users should update to this version or later to mitigate the risk.
If you cannot update immediately, avoid clicking on any untrusted links in markdown notes and consider disabling the markdown preview feature.
References
Related vulnerabilities
Recent vulnerabilities recorded for joplin.
