What is GHSA-mjr5-v9c9-mm7g?

GHSA-mjr5-v9c9-mm7g is a security advisory published by GitHub Security Advisories with High severity. Joplin Remote Code Execution

Which CVE IDs does GHSA-mjr5-v9c9-mm7g cover?

GHSA-mjr5-v9c9-mm7g covers the following CVE IDs: CVE-2022-40277. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mjr5-v9c9-mm7g?

GHSA-mjr5-v9c9-mm7g has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mjr5-v9c9-mm7g?

GHSA-mjr5-v9c9-mm7g affects 1 product, including: npm/joplin:\u003c= 2.8.8.

GHSA-mjr5-v9c9-mm7gHighCVSS 7.8

Joplin Remote Code Execution

Vendor

GitHub Security Advisories

Published

October 1, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2022-40277 →

📋 Description

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the shell.openExternal function.

🎯 Affected products1

npm/joplin:<= 2.8.8

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-40277
https://fluidattacks.com/advisories/skrillex
https://github.com/advisories/GHSA-mjr5-v9c9-mm7g