CVE-2025-25187: Joplin Note-Taking App XSS Vulnerability

CVE-2025-25187 Overview

Joplin, an open-source note-taking and to-do application, contains a cross-site scripting (XSS) vulnerability that escalates to arbitrary code execution. The flaw resides in the GotoAnything search feature, where note titles are injected into the document using React's dangerouslySetInnerHTML without HTML entity escaping. Compounding factors amplify the impact: Joplin lacks a restrictive Content-Security-Policy script-src directive, and the main Electron window is created with nodeIntegration set to true. Users who receive notes from untrusted sources and invoke the Ctrl+P search dialog trigger the injected payload. Version 3.1.24 addresses the issue.

Critical Impact
An attacker-supplied note title can execute arbitrary JavaScript in the desktop client, and Node integration allows that JavaScript to escalate to arbitrary code execution on the host.

Affected Products

Joplin desktop application versions prior to 3.1.24
Joplin project releases distributed by joplin_project
Installations that accept notes from external or shared sources

Discovery Timeline

2025-02-07 - CVE-2025-25187 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25187

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in Joplin's desktop client. The GotoAnything plugin renders search results, including note titles, directly into the DOM through React's dangerouslySetInnerHTML API. Because the titles are not passed through an HTML entity encoder, an attacker who controls note content can embed HTML tags with inline event handlers such as onclick or onload.

Joplin's Electron shell does not define a Content-Security-Policy that restricts inline script execution. The main BrowserWindow is instantiated with nodeIntegration: true, exposing Node.js APIs including require to any script executing inside the renderer. Combined, these three defects convert a title-based XSS into full remote code execution on the endpoint.

Root Cause

The root cause is missing output encoding in packages/app-desktop/plugins/GotoAnything.tsx. Note titles derived from user-supplied data flow into React's raw HTML sink without sanitization. Absent CSP restrictions and enabled Node integration make the missing escape a code execution primitive rather than a scripting-only issue.

Attack Vector

An attacker crafts a note with a malicious title containing HTML markup and inline event handlers. The victim imports or synchronizes the note from an untrusted source, then presses Ctrl+P to open the GotoAnything search dialog. When the title renders in the results list, the browser executes the embedded handler, invoking Node APIs to run arbitrary commands.

text

 import { NoteEntity, ResourceEntity } from '@joplin/lib/services/database/types';
 import Dialog from '../gui/Dialog';
 import AsyncActionQueue from '@joplin/lib/AsyncActionQueue';
+import { htmlentities } from '@joplin/utils/html';
 
 const logger = Logger.create('GotoAnything');

Source: Joplin Commit 360ece6. The patch introduces the htmlentities helper into GotoAnything.tsx so titles are HTML-encoded before rendering.

Detection Methods for CVE-2025-25187

Indicators of Compromise

Joplin note titles containing HTML tags, angle brackets, or event handler attributes such as onclick=, onerror=, or onload=.
Unexpected child processes spawned from the Joplin Electron process shortly after a user opens the Ctrl+P search dialog.
Outbound network connections from the Joplin renderer to unrecognized domains.

Detection Strategies

Scan the Joplin notes database for titles matching regular expressions that include HTML tags or JavaScript URI schemes.
Monitor endpoint telemetry for the Joplin process launching interpreters such as cmd.exe, powershell.exe, bash, or node.
Inspect installed Joplin versions across the fleet and flag any release earlier than 3.1.24.

Monitoring Recommendations

Log Joplin process ancestry and command line arguments through EDR tooling for post-hoc review.
Alert on Joplin writing to autorun locations, scheduled task stores, or user profile scripts.
Track Joplin sync sources and flag notebooks shared from external accounts.

How to Mitigate CVE-2025-25187

Immediate Actions Required

Upgrade every Joplin desktop client to version 3.1.24 or later.
Audit synchronized notebooks and remove notes sourced from untrusted parties.
Restrict Ctrl+P usage until upgrades are confirmed, especially on machines that pull notes from shared or public sources.

Patch Information

The fix is delivered in Joplin 3.1.24 and applied via commit 360ece6f8873ef81afbfb98b25faad696ffccdb6, which imports htmlentities from @joplin/utils/html and encodes note titles before passing them to dangerouslySetInnerHTML. See the GitHub Security Advisory GHSA-9gfv-q6wj-fr3c for advisory details.

Workarounds

No official workarounds exist; upgrading is the only supported remediation.
As a temporary control, avoid importing notes from unknown sources and refrain from using the GotoAnything search until the client is patched.

bash

# Verify installed Joplin version on Linux/macOS endpoints
joplin --version

# Example package upgrade on Debian-based systems using the official installer
wget -O - https://raw.githubusercontent.com/laurent22/joplin/dev/Joplin_install_and_update.sh | bash