CVE-2025-24028
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Joplin's Rich Text Editor caused by differences between Joplin's HTML sanitizer and browser comment handling. Attackers can execute arbitrary JavaScript when users open malicious notes in the Rich Text Editor. Only users who open untrusted notes in the Rich Text Editor are affected.
💻 Affected Systems
- Joplin
📦 What is this software?
Joplin by Joplin Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Joplin data including theft of notes, credentials, and local file access depending on Joplin's permissions and integrations.
Likely Case
Theft of sensitive notes, session hijacking, and potential malware delivery through Joplin's execution context.
If Mitigated
Limited impact if users only open trusted notes or use Markdown viewer exclusively (which has cross-origin isolation).
🎯 Exploit Status
Requires user interaction (opening malicious note). No public exploit code available as of advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.12
Vendor Advisory: https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
Restart Required: No
Instructions:
1. Open Joplin application. 2. Go to Help > Check for updates. 3. Follow prompts to update to version 3.2.12 or later. 4. Alternatively, download latest version from joplinapp.org.
🔧 Temporary Workarounds
Use Markdown Viewer Only
allSwitch to Markdown viewer mode which has cross-origin isolation preventing JavaScript execution
In Joplin settings, set default editor to Markdown
🧯 If You Can't Patch
- Avoid opening untrusted notes in Rich Text Editor
- Use Joplin in read-only mode for untrusted content
🔍 How to Verify
Check if Vulnerable:
Check Joplin version in Help > About. If version is between 3.1.24 and 3.2.12 (exclusive), you are vulnerable.Check Version:
joplin --version (CLI) or check Help > About in GUIVerify Fix Applied:
Verify version is 3.2.12 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual note creation/modification patterns
- Notes with suspicious HTML/JavaScript content
Network Indicators:
- None - local application vulnerability
SIEM Query:
Application logs showing Joplin process execution with suspicious note file access🔗 References
- https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
- https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
- https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
- https://joplinapp.org/help/dev/spec/note_viewer_isolation
- https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
