CVE-2025-25187: Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive `script-src`. This allows arbitrary JavaScript execution via inline `onclick`/`onload` event handlers in unsanitized HTML. Additionally, Joplin's main window is created with `nodeIntegration` set to `true`, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses <kbd>ctrl</kbd>-<kbd>p</kbd> to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25187?
CVE-2025-25187 has been classified as a high severity vulnerability due to the potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-25187?
To fix CVE-2025-25187, ensure that note titles are properly escaped before being added to the document using React's dangerouslySetInnerHTML.
Which versions of Joplin are affected by CVE-2025-25187?
CVE-2025-25187 affects Joplin versions prior to 3.1.24.
What kind of exploitation can occur with CVE-2025-25187?
Exploitation of CVE-2025-25187 can allow attackers to execute arbitrary JavaScript in the context of a victim's session.
Is there a patch available for CVE-2025-25187?
Yes, a patch for CVE-2025-25187 has been implemented in Joplin version 3.1.24 or later.