CVE-2022-40277

⚠️ high

Summary

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

CVSS Score

7.8

High

EPSS Score

0.1

Exploit Probability

Published Date

2022-09-30

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 360,548 vulnerabilities in our database.

#113,554

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 20, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-05-20

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-20

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-22810	⚠️ high	8.2	0.2	Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior...	2026-05-18
CVE-2022-35131	⛔ critical	9.0	1.9	Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.	2022-07-25
CVE-2021-23431	🔶 medium	5.4	0.1	The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in variou...	2021-08-24

CVE-2022-40277

Summary

📊 Relative Risk Intelligence

🎯 CISA SSVC Assessment Updated: May 20, 2025

📦 Affected Products 1

🔗 References 2

🔗 Related CVEs 3