Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e73p-589d-7qdm
Vulnerability ID VCID-e73p-589d-7qdm
Aliases CVE-2025-24028
Summary Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
epss 0.00342 https://api.first.org/data/v1/epss?cve=CVE-2025-24028
cvssv3.1 7.8 https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
ssvc Track https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
cvssv3.1 7.8 https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
ssvc Track https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
cvssv3.1 7.8 https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
ssvc Track https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
cvssv3.1 7.8 https://joplinapp.org/help/dev/spec/note_viewer_isolation
ssvc Track https://joplinapp.org/help/dev/spec/note_viewer_isolation
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-24028
2a058ed8097c2502e152b26394dc1917897f5817 https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
9b505395918bc923f34fe6f3b960bb10e8cf234e https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
GHSA-5w3c-wph9-hq92 https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
note_viewer_isolation https://joplinapp.org/help/dev/spec/note_viewer_isolation
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-10T17:17:07Z/ Found at https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-10T17:17:07Z/ Found at https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-10T17:17:07Z/ Found at https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://joplinapp.org/help/dev/spec/note_viewer_isolation
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-10T17:17:07Z/ Found at https://joplinapp.org/help/dev/spec/note_viewer_isolation
Exploit Prediction Scoring System (EPSS)
Percentile 0.56858
EPSS Score 0.00342
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T19:14:56.270253+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/edge/community.json 38.0.0