CVE-2023-39517

Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer (`packages/renderer/htmlUtils.ts::sanitizeHtml`) preserves `<map>` `<area>` links. However, unlike `<a>` links, the `target` and `href` attributes are not removed. Additionally, because the note preview pane isn't sandboxed to prevent top navigation, links with `target` set to `_top` can replace the toplevel electron page. Because any toplevel electron page, with Joplin's setup, has access to `require` and can require node libraries, a malicious replacement toplevel page can import `child_process` and execute arbitrary shell commands. This issue has been fixed in commit 7c52c3e9a81a52ef1b42a951f9deb9d378d59b0f which is included in release version 2.12.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandboxNot Applicable
• https://github.com/laurent22/joplin/commit/7c52c3e9a81a52ef1b42a951f9deb9d378d59b0fPatch
• https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5mExploit, Vendor Advisory
• https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandboxNot Applicable
• https://github.com/laurent22/joplin/commit/7c52c3e9a81a52ef1b42a951f9deb9d378d59b0fPatch
• https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5mExploit, Vendor Advisory

Published

Jun 21, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39511Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-39512Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-39513Cacti is an open source operational monitoring and fault man…5.4
• CVE-2023-39514Cacti is an open source operational monitoring and fault man…5.4
• CVE-2023-39515Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-39516Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-39518social-media-skeleton is an uncompleted social media project…5.4
• CVE-2023-39519Cloud Explorer Lite is an open source cloud management platf…4.9
• CVE-2023-39520Cryptomator encrypts data being stored on cloud infrastructu…7.8
• CVE-2023-39521Tuleap is an open source suite to improve management of soft…4.8
• CVE-2023-39522goauthentik is an open-source Identity Provider. In affected…5.3
• CVE-2023-39523ScanCode.io is a server to script and automate software comp…8.8