Vulnerability Details CVE-2022-40277
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 16.3%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2022-40277
-
cpe:2.3:a:joplinapp:joplin:2.8.8
-
cpe:2.3:o:canonical:ubuntu_linux:20.04
-
cpe:2.3:o:linux:linux_kernel:-