{"cve":"CVE-2024-49362","nvd":{"published":"2024-11-14T18:15:19.243","modified":"2026-06-17T07:59:46.080","status":"Analyzed","description":"Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-79","CWE-94"],"references":["https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"],"products":["joplin_project:joplin"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-49362","score":0.01065,"percentile":0.64708,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hff8-hjwv-j9q7","url":"https://osv.dev/vulnerability/GHSA-hff8-hjwv-j9q7","summary":"Remote Code Execution on click of <a> Link in markdown preview","modified":"2025-01-30T18:05:55Z","packages":[{"ecosystem":"npm","name":"joplin","purl":"pkg:npm/joplin","ranges":[">=3.0.0 <3.1.0"],"fixed":["3.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}