CVE-2023-37898

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. packages/renderer/MarkupToHtml.ts renders note content in safe mode by surrounding it with

Загрузка...

, without escaping any interior HTML tags. Thus, an attacker can create a note that closes the opening

Загрузка...