CVE-2024-49362 HIGH

CVE-2024-49362: Remote Code Execution on click of <a> Link in markdown preview

Vendor Laurent22
Product joplin
Weakness CWE-94 · Code injection
Published November 14, 2024
Last update November 14, 2024
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.

Key dates

02Disclosure timeline

November 14, 2024 CVE published
November 14, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-5466 Remote Code Execution CVE-2024-11002 InPost Gallery <= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input CVE-2025-4208 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function