CVE-2025-24028 is a high severity cross-site scripting flaw (CVSS 7.8) in the Joplin note taking app, reachable when you open an untrusted note in the Rich Text Editor. It is fixed in Joplin 3.2.12. Update the desktop app, and avoid opening notes from sources you do not trust until you have.
What's affected
The NVD record names Joplin from the joplin_project vendor. The advisory says the issue is not present in Joplin 3.1.24 and may have been introduced in a later commit, and that it is addressed in version 3.2.12. So the range to worry about runs from some release after 3.1.24 up to, but not including, 3.2.12. Confirm the exact boundary in the advisory.
The cause is a mismatch between how Joplin's HTML sanitizer treats comments and how the browser engine treats them. The advisory says this affects both the Rich Text Editor and the Markdown viewer. The Markdown viewer is cross-origin isolated, which stops script from reaching functions and variables in the top level Joplin window directly. The Rich Text Editor has no such barrier, and the advisory says users who open untrusted notes there are the ones affected.
The record is not on the CISA Known Exploited Vulnerabilities list.
The weakness is classed as CWE-79 (cross-site scripting). The score is 7.8 (HIGH). The vector, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reads as a local attack, low attack complexity, no privileges required and user interaction required. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-02-07.
The advisory and the record both name Joplin 3.2.12 as the release that addresses the issue, and say there are no known workarounds. Check the release notes for the current version, and update past 3.2.12 if a newer one is out.
How to check if you're exposed
Joplin is a desktop and mobile app, so this is a version check on each machine.
- Open Joplin and go to Help, then About Joplin, and read the version number.
- If it is 3.2.12 or later, you have the fix. If it is earlier, update from the official download page or your package manager.
- Ask whether anyone on your team opens notes that came from outside, such as shared notebooks, imported web clips or pasted content, and whether they use the Rich Text Editor for it.
- If you manage laptops centrally, search your software inventory for Joplin and its version.
There is no server component to check unless you run a Joplin Server, which is a separate product.
What to do now
- Update Joplin to 3.2.12 or later on every desktop that has it installed.
- Until you have updated, do not open notes from untrusted sources in the Rich Text Editor.
- Prefer the Markdown viewer for unknown notes, since the advisory says it is isolated from the main window, although it is not a substitute for updating.
- Add Joplin to your software inventory if it is not already there, so the next update reaches it.
Why it matters
Cross-site scripting, listed as CWE-79, lets attacker controlled markup run as script in a place that trusts it. Here the trigger is a sanitizer and a browser reading the same comment differently, so text the sanitizer thought was harmless becomes active content once the browser parses it. This kind of gap is often called a mutation or parsing differential problem.
In a web page, script is limited to that page. In a desktop app built on web technology, the same flaw can sit closer to the operating system. The vector scores high impact on all three of confidentiality, integrity and availability for that reason, and notes the need for user interaction because someone has to open the note.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Which Joplin version fixes CVE-2025-24028?
The record and the advisory name Joplin 3.2.12 as the release that addresses it. Update to that or later.
Is the Markdown viewer affected?
The advisory says the flaw affects both the Rich Text Editor and the Markdown viewer, but the viewer is cross-origin isolated, which blocks direct access to the main window. The editor is the main concern, and updating removes the problem in both.
Sources
- Safeguard Gold entry for CVE-2025-24028
- NVD record data for CVE-2025-24028 (published 2025-02-07)
- Joplin security advisory GHSA-5w3c-wph9-hq92
Last reviewed: 19 October 2026.
