CVE-2024-49362 Remote Code Execution on click of <a> Link in markdown preview
Attackers can execute arbitrary shell commands by tricking users into clicking malicious links in Joplin's markdown preview.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-49362?
CVE-2024-49362 is a high-severity code injection vulnerability in laurent22 joplin, published on 14 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
Which versions are affected by CVE-2024-49362?
2 open source packages ship an affected version, including joplin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
joplin npm | From 3.0.0 | 3.1.0 |
joplin npm | From 3.0.0 | 3.1.0 |
Products include Joplin Project Joplin.
How do I fix CVE-2024-49362?
Upgrade joplin to 3.1.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-49362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49362 exists.
Other vulnerabilities in laurent22 joplin
- CVE-2022-23340 Joplin Vulnerable to Code Injection
- CVE-2024-40643 Joplin has a parsing error leading to Cross-site Scripting (XSS)
- CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin
- CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint
- CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
Sources
Also known as GHSA-hff8-hjwv-j9q7.