Joplin_project Joplin
22 CVEs affecting Joplin_project Joplin. Latest disclosed: 2025-04-30. Critical: 2, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23340 | Critical | 9.8 | 2022-02-08 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. |
CVE-2024-40643 | Critical | 9.6 | 2024-09-09 | Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be cons… |
CVE-2023-45673 | High | 8.9 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows clicking on a link in… |
CVE-2025-27134 | High | 8.8 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a p… |
CVE-2023-39517 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untruste… |
CVE-2023-38506 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text ed… |
CVE-2023-37898 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to exe… |
CVE-2025-25187 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2025-24028 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2024-49362 | High | 7.7 | 2024-11-14 | Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user click… |
CVE-2025-27409 | High | 7.5 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, pat… |
CVE-2024-53268 | High | 7.2 | 2024-11-25 | Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are… |
CVE-2023-37299 | Medium | 6.1 | 2023-06-30 | Joplin before 2.11.5 allows XSS via an AREA element of an image map. |
CVE-2023-37298 | Medium | 6.1 | 2023-06-30 | Joplin before 2.11.5 allows XSS via a USE element in an SVG document. |
CVE-2022-45598 | Medium | 6.1 | 2023-01-31 | Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization. |
CVE-2021-37916 | Medium | 6.1 | 2021-08-03 | Joplin before 2.0.9 allows XSS via button and form in the note body. |
CVE-2020-28249 | Medium | 6.1 | 2020-11-06 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. |
CVE-2020-15930 | Medium | 6.1 | 2020-09-24 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. |
CVE-2018-1000534 | Medium | 6.1 | 2018-06-26 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS… |
CVE-2021-33295 | Medium | 5.4 | 2022-06-16 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. |