CVE-2024-49362

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-493637.4Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/m CVE-2024-493648.1tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-str CVE-2024-493658.1tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on CVE-2024-493667.5Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without ve CVE-2024-493677.5Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This iss CVE-2024-493689.8Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not v CVE-2024-493699.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2024-493704.9Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Ba CVE-2024-493734.3No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user ca CVE-2024-493759.0Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a m CVE-2024-493768.8Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in versi CVE-2024-493776.1OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected