Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-40277: Joplin 2.8.8 allows malicious links to execute commands on client

CVE-2022-40277 · published 4 years ago

Summary

Joplin version 2.8.8 has a security flaw that allows hackers to execute commands on your computer if you open a malicious link in a markdown file. This can happen if you open a link in a file that contains hidden code. We recommend updating to the latest version of Joplin to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	laurent22	joplin	<= 2.8.8
–	joplinapp	joplin	2.8.8 `cpe:2.3:a:joplinapp:joplin:2.8.8:::::::*`

Original advisory text

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

References

https://fluidattacks.com/advisories/skrillex
https://github.com/advisories/GHSA-mjr5-v9c9-mm7g
https://fluidattacks.com/advisories/skrillex/ Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40277 Vendor Advisory
https://github.com/laurent22/joplin Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40277... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published30 Sep 2022

Updated3 Nov 2026

First seen6 Mar 2026

Sources

GHSA-mjr5-v9c9-mm7g · GHSA

CVE-2022-40277 · NVD

CVE-2022-40277 · OSV

Track software like this

Free during beta