CVE-2024-55630 Information

Description

Joplin is a free open source note taking and to-do application which can handle a large number of notes organised into notebooks. Joplin’s HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property (e.g. querySelector) that property is replaced with the element. This vulnerability’s only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Reference

https://en.wikipedia.org/wiki/DOM_clobbering https://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9 https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh