CVE-2020-28249 - Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note

MEDIUM

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note

Published Nov 6, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 3.06%

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

Ecosystem	Package	Introduced	Fixed
npm	joplin	0	1.3.11

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://github.com/advisories/GHSA-q26w-wjj2-22vv		Advisory
https://github.com/fhlip0/JopinXSS		x_refsource_MISCExploitThird Party Advisory
https://github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13
https://github.com/laurent22/joplin/releases		x_refsource_MISCThird Party Advisory
https://github.com/laurent22/joplin/releases/tag/v1.3.11
https://nvd.nist.gov/vuln/detail/CVE-2020-28249
https://www.npmjs.com/package/joplin