-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe key vulnerability stems from the MarkdownIt configuration in MdToHtml.js where HTML support was explicitly enabled ('html: true'). This allowed arbitrary HTML tags in note content, which combined with Electron's nodeIntegration enabled in the rendering process, could lead to XSS escalating to code execution. The fix explicitly disables HTML support ('html: false') while maintaining limited <br> tag support through a controlled replacement, confirming this was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| joplin | npm | < 1.0.90 | 1.0.90 |