CVE-2018-1000534 Joplin Vulnerable to Cross-site Scripting in Note Content
Attackers can execute arbitrary code via XSS in note content when victims sync malicious notes, due to enabled nodeIntegration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000534?
CVE-2018-1000534 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 that can result in executing unauthorized code within the rights in which the application is running. This attack appear to be exploitable via Victim synchronizing notes from the cloud services or other note-keeping services which contain malicious code. This vulnerability appears to have been fixed in 1.0.90 and later.
Weakness: CWE-79
Which versions are affected by CVE-2018-1000534?
2 open source packages ship an affected version, including joplin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
joplin npm | All versions | 1.0.90 |
joplin npm | All versions | 1.0.90 |
Products include Joplin Project Joplin.
How do I fix CVE-2018-1000534?
Upgrade joplin to 1.0.90 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-1000534 being exploited?
There is no known exploitation of CVE-2018-1000534 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-23340 Joplin Vulnerable to Code Injection
- CVE-2024-40643 Joplin has a parsing error leading to Cross-site Scripting (XSS)
- CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin
- CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint
- CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
Sources
Also known as GHSA-m6mf-hmrh-ph4j.