CVE-2024-55630: DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Vulnerability summary

CVE-2024-55630 is a medium (CVSS 5.5) Improper Input Validation vulnerability in joplin_project joplin. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-02-2025
   PublishedVulnerability first disclosed.
2. 10-02-2025
   Last modifiedVulnerability information updated.

Description

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.