CVE-2024-49362 - CVE House

Back to Database

Status published High CVE-2024-49362

Remote Code Execution on click of <a> Link in markdown preview

7.7 CVSS

Vulnerability Description

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-49362

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7

More from laurent22

View All →

Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input

Joplin Server Vulnerable to Path Traversal

Privilege escalation in Joplin server via user patch endpoint

Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin

Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin

Affected Vendor

laurent22

View all reports →

Affected Software

joplin

Vulnerable Versions:

< 3.1

Timeline

Official Publish: November 14th, 2024

Last Modified: November 14th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation