Vulnerabilities > CVE-2025-25187 - Unspecified vulnerability in Joplin Project Joplin

CVSS 5.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

joplin-project

NVD

Published: 2025-02-07

Updated: 2025-04-11

Summary

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive `script-src`. This allows arbitrary JavaScript execution via inline `onclick`/`onload` event handlers in unsanitized HTML. Additionally, Joplin's main window is created with `nodeIntegration` set to `true`, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses <kbd>ctrl</kbd>-<kbd>p</kbd> to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Joplin_Project Joplin Project Joplin 0.10.0 Joplin Project Joplin 0.10.1 Joplin Project Joplin 0.10.2 Joplin Project Joplin 0.10.3 Joplin Project Joplin 0.10.4 Joplin Project Joplin 0.10.5 Joplin Project Joplin 0.10.6 Joplin Project Joplin 0.10.7 Joplin Project Joplin 0.10.8 Joplin Project Joplin 0.10.9 Joplin Project Joplin 0.10.14 Joplin Project Joplin 0.10.15 Joplin Project Joplin 0.10.16 Joplin Project Joplin 0.10.17 Joplin Project Joplin 0.10.18 Joplin Project Joplin 0.10.19 Joplin Project Joplin 0.10.20 Joplin Project Joplin 0.10.21 Joplin Project Joplin 0.10.22 Joplin Project Joplin 0.10.23 Joplin Project Joplin 0.10.24 Joplin Project Joplin 0.10.25 Joplin Project Joplin 0.10.26 Joplin Project Joplin 0.10.27 Joplin Project Joplin 0.10.28 Joplin Project Joplin 0.10.29 Joplin Project Joplin 0.10.30 Joplin Project Joplin 0.10.31 Joplin Project Joplin 0.10.32 Joplin Project Joplin 0.10.33 Joplin Project Joplin 0.10.34 Joplin Project Joplin 0.10.35 Joplin Project Joplin 0.10.36 Joplin Project Joplin 0.10.37 Joplin Project Joplin 0.10.38 Joplin Project Joplin 0.10.39 Joplin Project Joplin 0.10.40 Joplin Project Joplin 0.10.41 Joplin Project Joplin 0.10.42 Joplin Project Joplin 0.10.43 Joplin Project Joplin 0.10.44 Joplin Project Joplin 0.10.45 Joplin Project Joplin 0.10.46 Joplin Project Joplin 0.10.47 Joplin Project Joplin 0.10.48 Joplin Project Joplin 0.10.49 Joplin Project Joplin 0.10.50 Joplin Project Joplin 0.10.51 Joplin Project Joplin 0.10.52 Joplin Project Joplin 0.10.53 Joplin Project Joplin 0.10.54 Joplin Project Joplin 0.10.55 Joplin Project Joplin 0.10.56 Joplin Project Joplin 0.10.57 Joplin Project Joplin 0.10.58 Joplin Project Joplin 0.10.59 Joplin Project Joplin 0.10.60 Joplin Project Joplin 0.10.61 Joplin Project Joplin 0.10.65 Joplin Project Joplin 0.10.92 Joplin Project Joplin 1.0.62 Joplin Project Joplin 1.0.63 Joplin Project Joplin 1.0.64 Joplin Project Joplin 1.0.65 Joplin Project Joplin 1.0.66 Joplin Project Joplin 1.0.67 Joplin Project Joplin 1.0.68 Joplin Project Joplin 1.0.69 Joplin Project Joplin 1.0.70 Joplin Project Joplin 1.0.71 Joplin Project Joplin 1.0.72 Joplin Project Joplin 1.0.73 Joplin Project Joplin 1.0.74 Joplin Project Joplin 1.0.75 Joplin Project Joplin 1.0.76 Joplin Project Joplin 1.0.77 Joplin Project Joplin 1.0.78 Joplin Project Joplin 1.0.79 Joplin Project Joplin 1.0.80 Joplin Project Joplin 1.0.81 Joplin Project Joplin 1.0.82 Joplin Project Joplin 1.0.83 Joplin Project Joplin 1.0.84 Joplin Project Joplin 1.0.85 Joplin Project Joplin 1.0.86 Joplin Project Joplin 1.0.87 Joplin Project Joplin 1.0.88 Joplin Project Joplin 1.0.89 Joplin Project Joplin 1.0.90 Joplin Project Joplin 1.0.91 Joplin Project Joplin 1.0.92 Joplin Project Joplin 1.0.93 Joplin Project Joplin 1.0.94 Joplin Project Joplin 1.0.95 Joplin Project Joplin 1.0.96 Joplin Project Joplin 1.0.97 Joplin Project Joplin 1.0.98 Joplin Project Joplin 1.0.99 Joplin Project Joplin 1.0.100 Joplin Project Joplin 1.0.101 Joplin Project Joplin 1.0.102 Joplin Project Joplin 1.0.103 Joplin Project Joplin 1.0.104 Joplin Project Joplin 1.0.105 Joplin Project Joplin 1.0.106 Joplin Project Joplin 1.0.107 Joplin Project Joplin 1.0.108 Joplin Project Joplin 1.0.109 Joplin Project Joplin 1.0.110 Joplin Project Joplin 1.0.111 Joplin Project Joplin 1.0.112 Joplin Project Joplin 1.0.113 Joplin Project Joplin 1.0.114 Joplin Project Joplin 1.0.115 Joplin Project Joplin 1.0.116 Joplin Project Joplin 1.0.117 Joplin Project Joplin 1.0.118 Joplin Project Joplin 1.0.119 Joplin Project Joplin 1.0.120 Joplin Project Joplin 1.0.123 Joplin Project Joplin 1.0.124 Joplin Project Joplin 1.0.125 Joplin Project Joplin 1.0.126 Joplin Project Joplin 1.0.127 Joplin Project Joplin 1.0.128 Joplin Project Joplin 1.0.129 Joplin Project Joplin 1.0.130 Joplin Project Joplin 1.0.131 Joplin Project Joplin 1.0.132 Joplin Project Joplin 1.0.133 Joplin Project Joplin 1.0.134 Joplin Project Joplin 1.0.135 Joplin Project Joplin 1.0.136 Joplin Project Joplin 1.0.137 Joplin Project Joplin 1.0.138 Joplin Project Joplin 1.0.139 Joplin Project Joplin 1.0.140 Joplin Project Joplin 1.0.141 Joplin Project Joplin 1.0.142 Joplin Project Joplin 1.0.143 Joplin Project Joplin 1.0.144 Joplin Project Joplin 1.0.145 Joplin Project Joplin 1.0.146 Joplin Project Joplin 1.0.147 Joplin Project Joplin 1.0.148 Joplin Project Joplin 1.0.149 Joplin Project Joplin 1.0.150 Joplin Project Joplin 1.0.151 Joplin Project Joplin 1.0.152 Joplin Project Joplin 1.0.153 Joplin Project Joplin 1.0.154 Joplin Project Joplin 1.0.155 Joplin Project Joplin 1.0.156 Joplin Project Joplin 1.0.157 Joplin Project Joplin 1.0.158 Joplin Project Joplin 1.0.159 Joplin Project Joplin 1.0.160 Joplin Project Joplin 1.0.161 Joplin Project Joplin 1.0.162 Joplin Project Joplin 1.0.163 Joplin Project Joplin 1.0.164 Joplin Project Joplin 1.0.165 Joplin Project Joplin 1.0.166 Joplin Project Joplin 1.0.167 Joplin Project Joplin 1.0.168 Joplin Project Joplin 1.0.169 Joplin Project Joplin 1.0.170 Joplin Project Joplin 1.0.171 Joplin Project Joplin 1.0.172 Joplin Project Joplin 1.0.173 Joplin Project Joplin 1.0.174 Joplin Project Joplin 1.0.175 Joplin Project Joplin 1.0.176 Joplin Project Joplin 1.0.177 Joplin Project Joplin 1.0.178 Joplin Project Joplin 1.0.179 Joplin Project Joplin 1.0.180 Joplin Project Joplin 1.0.181 Joplin Project Joplin 1.0.182 Joplin Project Joplin 1.0.183 Joplin Project Joplin 1.0.184 Joplin Project Joplin 1.0.185 Joplin Project Joplin 1.0.186 Joplin Project Joplin 1.0.187 Joplin Project Joplin 1.0.188 Joplin Project Joplin 1.0.189 Joplin Project Joplin 1.0.190 Joplin Project Joplin 1.0.191 Joplin Project Joplin 1.0.192 Joplin Project Joplin 1.0.193 Joplin Project Joplin 1.0.194 Joplin Project Joplin 1.0.195 Joplin Project Joplin 1.0.196 Joplin Project Joplin 1.0.197 Joplin Project Joplin 1.0.198 Joplin Project Joplin 1.0.199 Joplin Project Joplin 1.0.200 Joplin Project Joplin 1.0.201 Joplin Project Joplin 1.0.202 Joplin Project Joplin 1.0.203 Joplin Project Joplin 1.0.204 Joplin Project Joplin 1.0.205 Joplin Project Joplin 1.0.206 Joplin Project Joplin 1.0.207 Joplin Project Joplin 1.0.208 Joplin Project Joplin 1.0.209 Joplin Project Joplin 1.0.210 Joplin Project Joplin 1.0.211 Joplin Project Joplin 1.0.212 Joplin Project Joplin 1.0.213 Joplin Project Joplin 1.0.214 Joplin Project Joplin 1.0.215 Joplin Project Joplin 1.0.216 Joplin Project Joplin 1.0.217 Joplin Project Joplin 1.0.218 Joplin Project Joplin 1.0.219 Joplin Project Joplin 1.0.220 Joplin Project Joplin 1.0.221 Joplin Project Joplin 1.0.222 Joplin Project Joplin 1.0.223 Joplin Project Joplin 1.0.224 Joplin Project Joplin 1.0.225 Joplin Project Joplin 1.0.226 Joplin Project Joplin 1.0.227 Joplin Project Joplin 1.0.228 Joplin Project Joplin 1.0.229 Joplin Project Joplin 1.0.230 Joplin Project Joplin 1.0.231 Joplin Project Joplin 1.0.232 Joplin Project Joplin 1.0.233 Joplin Project Joplin 1.0.234 Joplin Project Joplin 1.0.235 Joplin Project Joplin 1.0.236 Joplin Project Joplin 1.0.237 Joplin Project Joplin 1.0.238 Joplin Project Joplin 1.0.239 Joplin Project Joplin 1.0.240 Joplin Project Joplin 1.0.241 Joplin Project Joplin 1.0.242 Joplin Project Joplin 1.0.243 Joplin Project Joplin 1.0.245 Joplin Project Joplin 1.1.1 Joplin Project Joplin 1.1.2 Joplin Project Joplin 1.1.3 Joplin Project Joplin 1.1.4 Joplin Project Joplin 1.1.244 Joplin Project Joplin 1.2.1 Joplin Project Joplin 1.2.2 Joplin Project Joplin 1.2.3 Joplin Project Joplin 1.2.4 Joplin Project Joplin 1.2.5 Joplin Project Joplin 1.2.6 Joplin Project Joplin 1.3.1 Joplin Project Joplin 1.3.2 Joplin Project Joplin 1.3.3 Joplin Project Joplin 1.3.4 Joplin Project Joplin 1.3.5 Joplin Project Joplin 1.3.6 Joplin Project Joplin 1.3.7 Joplin Project Joplin 1.3.8 Joplin Project Joplin 1.3.9 Joplin Project Joplin 1.3.10 Joplin Project Joplin 1.3.11 Joplin Project Joplin 1.3.12 Joplin Project Joplin 1.3.14 Joplin Project Joplin 1.3.15 Joplin Project Joplin 1.3.16 Joplin Project Joplin 1.3.17 Joplin Project Joplin 1.3.18 Joplin Project Joplin 1.4.1 Joplin Project Joplin 1.4.2 Joplin Project Joplin 1.4.3 Joplin Project Joplin 1.4.4 Joplin Project Joplin 1.4.5 Joplin Project Joplin 1.4.6 Joplin Project Joplin 1.4.7 Joplin Project Joplin 1.4.8 Joplin Project Joplin 1.4.9 Joplin Project Joplin 1.4.10 Joplin Project Joplin 1.4.11 Joplin Project Joplin 1.4.12 Joplin Project Joplin 1.4.13 Joplin Project Joplin 1.4.14 Joplin Project Joplin 1.4.15 Joplin Project Joplin 1.4.16 Joplin Project Joplin 1.4.18 Joplin Project Joplin 1.4.19 Joplin Project Joplin 1.5.1 Joplin Project Joplin 1.5.2 Joplin Project Joplin 1.5.3 Joplin Project Joplin 1.5.4 Joplin Project Joplin 1.5.5 Joplin Project Joplin 1.5.6 Joplin Project Joplin 1.5.7 Joplin Project Joplin 1.5.8 Joplin Project Joplin 1.5.9 Joplin Project Joplin 1.5.10 Joplin Project Joplin 1.5.11 Joplin Project Joplin 1.5.12 Joplin Project Joplin 1.5.13 Joplin Project Joplin 1.5.14 Joplin Project Joplin 1.6.1 Joplin Project Joplin 1.6.2 Joplin Project Joplin 1.6.3 Joplin Project Joplin 1.6.4 Joplin Project Joplin 1.6.5 Joplin Project Joplin 1.6.6 Joplin Project Joplin 1.6.7 Joplin Project Joplin 1.6.8 Joplin Project Joplin 1.7.1 Joplin Project Joplin 1.7.2 Joplin Project Joplin 1.7.3 Joplin Project Joplin 1.7.4 Joplin Project Joplin 1.7.5 Joplin Project Joplin 1.7.6 Joplin Project Joplin 1.7.7 Joplin Project Joplin 1.7.8 Joplin Project Joplin 1.7.9 Joplin Project Joplin 1.7.10 Joplin Project Joplin 1.7.11 Joplin Project Joplin 1.8.1 Joplin Project Joplin 1.8.2 Joplin Project Joplin 1.8.3 Joplin Project Joplin 1.8.4 Joplin Project Joplin 1.8.5 Joplin Project Joplin 2.0.1 Joplin Project Joplin 2.0.2 Joplin Project Joplin 2.0.3 Joplin Project Joplin 2.0.4 Joplin Project Joplin 2.0.5 Joplin Project Joplin 2.0.6 Joplin Project Joplin 2.0.7 Joplin Project Joplin 2.0.8 Joplin Project Joplin 2.0.9 Joplin Project Joplin 2.0.10 Joplin Project Joplin 2.0.11 Joplin Project Joplin 2.0.12 Joplin Project Joplin 2.0.13 Joplin Project Joplin 2.0.14 Joplin Project Joplin 2.1.1 Joplin Project Joplin 2.1.2 Joplin Project Joplin 2.1.3 Joplin Project Joplin 2.1.4 Joplin Project Joplin 2.1.5 Joplin Project Joplin 2.1.6 Joplin Project Joplin 2.1.7 Joplin Project Joplin 2.1.8 Joplin Project Joplin 2.1.9 Joplin Project Joplin 2.2.1 Joplin Project Joplin 2.2.2 Joplin Project Joplin 2.2.3 Joplin Project Joplin 2.2.4 Joplin Project Joplin 2.2.5 Joplin Project Joplin 2.2.6 Joplin Project Joplin 2.2.7 Joplin Project Joplin 2.2.8 Joplin Project Joplin 2.2.9 Joplin Project Joplin 2.2.10 Joplin Project Joplin 2.2.11 Joplin Project Joplin 2.3.1 Joplin Project Joplin 2.3.2 Joplin Project Joplin 2.3.3 Joplin Project Joplin 2.3.4 Joplin Project Joplin 2.3.5 Joplin Project Joplin 2.3.6 Joplin Project Joplin 2.3.7 Joplin Project Joplin 2.4.1 Joplin Project Joplin 2.7.9 Joplin Project Joplin 2.7.10 Joplin Project Joplin 2.7.11 Joplin Project Joplin 2.7.12 Joplin Project Joplin 2.7.13 Joplin Project Joplin 2.7.14 Joplin Project Joplin 2.7.15 Joplin Project Joplin 2.8.1 Joplin Project Joplin 2.8.2 Joplin Project Joplin 2.8.3 Joplin Project Joplin 2.8.4 Joplin Project Joplin 2.8.5 Joplin Project Joplin 2.8.6 Joplin Project Joplin 2.8.7 Joplin Project Joplin 2.8.8 Joplin Project Joplin 2.9.1 Joplin Project Joplin 2.9.2 Joplin Project Joplin 2.9.3 Joplin Project Joplin 2.9.4 Joplin Project Joplin 2.9.5 Joplin Project Joplin 2.9.6 Joplin Project Joplin 2.9.7 Joplin Project Joplin 2.9.8 Joplin Project Joplin 2.9.9 Joplin Project Joplin 2.9.10 Joplin Project Joplin 2.9.11 Joplin Project Joplin 2.9.12 Joplin Project Joplin 2.9.13 Joplin Project Joplin 2.9.14 Joplin Project Joplin 2.9.15 Joplin Project Joplin 2.9.16 Joplin Project Joplin 2.9.17 Joplin Project Joplin 2.10.1 Joplin Project Joplin 2.10.2 Joplin Project Joplin 2.10.3 Joplin Project Joplin 2.10.4 Joplin Project Joplin 2.10.5 Joplin Project Joplin 2.10.6 Joplin Project Joplin 2.10.7 Joplin Project Joplin 2.10.8 Joplin Project Joplin 2.10.9 Joplin Project Joplin 2.10.10 Joplin Project Joplin 2.10.11 Joplin Project Joplin 2.10.12 Joplin Project Joplin 2.10.13 Joplin Project Joplin 2.10.14 Joplin Project Joplin 2.10.15 Joplin Project Joplin 2.10.16 Joplin Project Joplin 2.10.17 Joplin Project Joplin 2.10.18 Joplin Project Joplin 2.10.19 Joplin Project Joplin 2.10.20 Joplin Project Joplin 2.11.1 Joplin Project Joplin 2.11.2 Joplin Project Joplin 2.11.3 Joplin Project Joplin 2.11.4 Joplin Project Joplin 2.11.5 Joplin Project Joplin 2.11.6 Joplin Project Joplin 2.11.7 Joplin Project Joplin 2.11.8 Joplin Project Joplin 2.11.9 Joplin Project Joplin 2.11.10 Joplin Project Joplin 2.11.11	450

Summary

Vulnerable Configurations

References