CVE-2022-35131
Critical · CVSS 9.0Joplin — Cross-Site Scripting (XSS) leading to Remote Code Execution via crafted Node titles
- CVSS
- 9.0
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-79
Description
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Search profile — drives PoC discovery
Symbols Node titlescrafted payloadjoplinnpm:joplinarbitrary commands
Keywords CVE-2022-35131Joplin XSS RCEJoplin node title injectionJoplin arbitrary command executionJoplin v2.8.8 exploitJoplin CVE-2022-35131 PoC
Versions: <=2.8.8
Ranked PoCs (5) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 3
- ★ 0SYRTI/POC_to_review needs reviewtrickest
- ★ 0WhooAmii/POC_to_review needs reviewtrickest
- ★ 0trhacknon/Pocingit needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
Affected packages
| npm | joplin | 0 → 2.9.1 |
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z