CVE-2022-35131
CriticalCVSS 9.0Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.
Risk Assessment
An attacker can gain full control over the affected system by executing arbitrary commands in the context of the Joplin user. This could lead to data theft, malware installation, or further compromise of the organization's infrastructure.
Recommendation
Upgrade Joplin to a version newer than 2.8.8 immediately. Until the update is applied, avoid opening notes from untrusted sources.
Other vulnerabilities in Joplin
See all- CVE-2026-34600Medium
Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.
- CVE-2025-57798Medium
Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.
- CVE-2026-22810High
Joplin prior to version 3.5.7 contains a path traversal vulnerability in the importer, allowing arbitrary file overwrite. The OneNote converter does not sanitize embedded file names, enabling ../.. sequences.
- CVE-2023-37299Medium
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
- CVE-2023-37298Medium
Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.
Original NVD description (English source)
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.