CVE Catalog
CVE-2022-35131
CriticalCVSS 9.0Exploitation Probability (EPSS)
High risk1.86%
77th percentile - higher than 77% of all known CVEs
Summary
Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.
Risk Assessment
An attacker can gain full control over the affected system by executing arbitrary commands in the context of the Joplin user. This could lead to data theft, malware installation, or further compromise of the organization's infrastructure.
Recommendation
Upgrade Joplin to a version newer than 2.8.8 immediately. Until the update is applied, avoid opening notes from untrusted sources.
Original NVD description (English source)
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.