{"id":"CVE-2020-15930","details":"An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.","aliases":["GHSA-cgc7-mwp4-3ccx"],"modified":"2026-08-07T16:49:41.622358Z","published":"2020-09-24T19:15:11.713Z","references":[{"type":"ADVISORY","url":"https://github.com/laurent22/joplin/issues/3552"},{"type":"ADVISORY","url":"https://github.com/laurent22/joplin/releases/tag/v1.1.4"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/159316/Joplin-1.0.245-Cross-Site-Scripting-Code-Execution.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laurent22/joplin","events":[{"introduced":"8ba9e9efd8226a07ecb9ae95db598351de4731f2"},{"last_affected":"2aa7eaa1928e348eac913b91f10c1fecf89ba322"},{"fixed":"9610b7e6bd815959912dd34c4cd32dd87b37ac39"}],"database_specific":{"cpe":"cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.190"},{"last_affected":"1.0.245"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.1.3","v1.1.2","v1.1.1","v1.0.245","v1.1.244","v1.0.242","v1.0.243","android-v1.0.340","android-v1.0.339-3","v1.0.239","v1.0.238","v1.0.235","android-v1.0.337","v1.0.234","v1.0.214","v1.0.213","v1.0.212","v1.0.211","v1.0.210","v1.0.209","v1.0.208","cli-v1.0.164","v1.0.207","v1.0.206","v1.0.200","cli-v1.0.163","ios-v10.0.47","android-v1.0.327","v1.0.199","android-v1.0.326","v1.0.198","cli-v1.0.162","v1.0.197","android-v1.0.325","v1.0.196","android-v1.0.324","android-v1.0.323","v1.0.195","v1.0.194","android-v1.0.322","android-v1.0.321","clipper-1.0.25","clipper-1.0.23","ios-v10.0.45","android-v1.0.320","v1.0.193","cli-v1.0.161","cli-v1.0.160","cli-v1.0.159","cli-v1.0.158","cli-v1.0.157","cli-v1.0.156","android-v1.0.319-rc1","v1.0.192","v1.0.191","v1.0.190"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15930.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}