CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

CVSS v3.1 NVD

9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

2.31% chance of exploitation in the next 30 days, 83rd percentile

Published

2022-07-25

Updated

2026-07-09

Proof-of-concept exploits (1)

• ly1g3/Joplin-CVE-2022-351313★ · 2022-07-25

Security advisories

• laurent22/joplin/releases/tag/v2.9.1
• advisories/GHSA-ww2v-frv5-pj5x

References

• CVE Record
• NVD entry

Related

• CVE-2022-31138
• CVE-2022-31245
• CVE-2022-35132
• CVE-2022-36880
• CVE-2022-46332
• CVE-2022-46333