{"id":"CVE-2021-33295","published":"2022-06-16T20:36:16Z","modified":"2024-08-03T23:42:20Z","title":"Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00852,"percentile":0.58229,"provenance":"source"},"cwes":[],"references":[{"url":"https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/laurent22/joplin/releases/tag/v1.8.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf","tags":["x_refsource_MISC"]}],"priority":{"score":11.6,"factors":[{"name":"EPSS percentile","points":11.65}]},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<1.8.5"],"patched":["1.8.5"],"from":["GHSA-phj8-2p6x-hq5r"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6113","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-joplin-cve-2020-9038","parents":[{"from":"CVE-2021-37916","to":"CVE-2021-33295","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/renderer/htmlUtils.ts"],"commits":["https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf","https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26"],"basis":"shared function","functions":["HtmlUtils"]}]},{"from":"CVE-2022-23340","to":"CVE-2021-33295","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/renderer/htmlUtils.ts"],"commits":["https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf","https://github.com/laurent22/joplin/commit/810018b41f4d9f0c2fd9af4b8fd332fa4a0210f0"],"basis":"shared function","functions":["HtmlUtils"]}]}],"children":[{"from":"CVE-2021-33295","to":"CVE-2023-37298","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/renderer/htmlUtils.ts"],"commits":["https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf","https://github.com/laurent22/joplin/commit/caf66068bfc474bbfd505013076ed173cd90ca83"],"basis":"shared function","functions":["HtmlUtils"]}]},{"from":"CVE-2021-33295","to":"CVE-2023-37299","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/renderer/htmlUtils.ts"],"commits":["https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf","https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071"],"basis":"shared function","functions":["HtmlUtils"]}]}],"packageHistory":[{"cve":"CVE-2020-15930","published":"2020-09-24","fixed":"1.1.7","kev":false},{"cve":"CVE-2020-9038","published":"2020-02-17","fixed":"1.2.1","kev":false},{"cve":"CVE-2020-28249","published":"2020-11-06","fixed":"1.3.11","kev":false,"link":{"from":"CVE-2020-28249","to":"CVE-2021-33295","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"1.3.11","toFixed":"1.8.5","daysApart":587}]}},{"cve":"CVE-2021-33295","published":"2022-06-16","fixed":"1.8.5","kev":false},{"cve":"CVE-2021-37916","published":"2021-08-02","fixed":"2.0.9","kev":false},{"cve":"CVE-2021-23431","published":"2021-08-24","fixed":"2.3.2","kev":false},{"cve":"CVE-2022-23340","published":"2022-02-08","fixed":"2.7.1","kev":false}],"package":"npm:joplin"}}