CVE-2022-23340 Joplin Vulnerable to Code Injection
Remote attackers can execute system commands via malicious code in user search results within the Joplin application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23340?
CVE-2022-23340 is a critical command injection vulnerability in n/a, published on 8 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.
Which versions are affected by CVE-2022-23340?
2 open source packages ship an affected version, including joplin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
joplin npm | All versions | 2.7.1 |
joplin npm | All versions | 2.7.1 |
Products include Joplin Project Joplin.
How do I fix CVE-2022-23340?
Upgrade joplin to 2.7.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-23340 being exploited?
There is no known exploitation of CVE-2022-23340 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-40643 Joplin has a parsing error leading to Cross-site Scripting (XSS)
- CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin
- CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint
- CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
- CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin
Sources
Also known as GHSA-8478-53pv-jxvm.