CVE-2022-40277

2022-09-3016:20:59

Fluid Attacks

www.cve.org

joplin

version 2.8.8

remote attackers

execute arbitrary commands

malicious markdown file

shell.openexternal function

0.001 Low

EPSS

Percentile

36.2%

JSON

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the ‘shell.openExternal’ function.

CNA Affected

[
  {
    "product": "Joplin",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.8"
      }
    ]
  }
]

References

fluidattacks.com/advisories/skrillex/

github.com/laurent22/joplin

0.001 Low

EPSS

Percentile

36.2%

JSON

Related for CVELIST:CVE-2022-40277