CVE-2023-45673 is a high severity code execution flaw in the Joplin desktop note taking app. Clicking a link in a PDF inside an untrusted note can run shell commands. NVD scores it 8.9 and the project advisory 8.1. Upgrade to version 2.13.3 or later.
What's affected
Per the Joplin GitHub advisory (GHSA-g8qx-5vcm-3x59), Joplin desktop versions below 2.13.3 are affected and 2.13.3 is the patched release. The NVD record agrees on the fix: the issue was addressed in version 2.13.3, and the description says there are no known workarounds.
The sources differ on severity. The NVD record scores it 8.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. The project's own advisory scores it 8.1 with CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. Both are High. The only difference in the vectors is the attack vector, network in one and local in the other.
The advisory adds a condition: the impact applies to people who attach untrusted PDFs to notes and have the tray icon enabled, which it says is the default on Windows and macOS.
How to check if you're exposed
Open Joplin, go to the Help menu and choose About Joplin. The dialog shows the installed version. Any desktop version below 2.13.3 is in scope.
If you manage Joplin across many machines, check your software inventory or package manager. On macOS with Homebrew, for example:
brew list --cask --versions joplin
Mobile and terminal apps are separate products. The advisory concerns Joplin desktop, which is the Electron based app with node integration.
What to do now
- Check the Joplin version on every machine that has it, using Help then About Joplin.
- Upgrade to 2.13.3 or later.
- Until the upgrade, do not click links inside PDFs that came from untrusted notes or imports.
- Review notes you imported or synced from others for PDF attachments you do not recognize.
- Check the project's release notes for later versions and keep auto update on.
Why it matters
The weakness is code injection, CWE-94. The advisory explains the chain in two parts: the desktop app had not disabled top level redirection for the iframes that display notes, and node integration was enabled. Together, a link in a PDF could navigate the app's own window to attacker controlled content, which then ran with access to the local system.
It is a good example of why Electron applications keep a strict boundary between displayed content and the node runtime. A sandbox attribute on an iframe is the standard control for this, and the advisory points to the MDN documentation on iframe sandboxing.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation. The practical risk is shared notebooks, imported notes and anything else that brings in a PDF you did not create.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which severity score is right, 8.9 or 8.1?
Both sources rate it High. NVD says 8.9 and the Joplin advisory says 8.1, with a different attack vector in each. Use the advisory for the project's own view.
Is there a workaround?
The advisory lists none. The remedy is version 2.13.3.
Sources
Last reviewed: 19 October 2026.
