CVE-2022-40277: Input Validation
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
Other sources
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the shell.openExternal function.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-40277?
CVE-2022-40277 is a vulnerability in Joplin version 2.8.8 that allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file.
How does CVE-2022-40277 work?
CVE-2022-40277 works by exploiting the lack of proper validation of the schema/protocol of existing links in markdown files opened in Joplin, allowing an attacker to execute arbitrary commands remotely.
What is the severity of CVE-2022-40277?
The severity of CVE-2022-40277 is high, with a CVSS score of 7.8.
Which software versions are affected by CVE-2022-40277?
Joplin version 2.8.8 is affected by CVE-2022-40277.
How can I fix CVE-2022-40277?
To fix CVE-2022-40277, it is recommended to update Joplin to a version that includes the necessary security patches.