{"id":"CVE-2022-28101","details":"Turtlapp Turtle Note v0.7.2.6 does not filter the \u003cmeta\u003e tag during markdown parsing, allowing attackers to execute HTML injection.","modified":"2026-08-12T03:51:28.400147603Z","published":"2022-04-28T13:55:08Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28101.json"},"references":[{"type":"WEB","url":"https://www.cybercitadel.com/html-injection-turtl/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28101.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28101"},{"type":"REPORT","url":"https://github.com/turtl/tracker/issues/404"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/turtl/android","events":[{"introduced":"e2a87ce41dcf575a15ae79d95d2c3c21ae76b9f7"},{"last_affected":"e2a87ce41dcf575a15ae79d95d2c3c21ae76b9f7"}],"database_specific":{"cpe":["cpe:2.3:a:lyonbros:turtl:0.7.2.6:*:*:*:-:android:*:*","cpe:2.3:a:lyonbros:turtl:0.7.2.6:*:*:*:-:ios:*:*"],"extracted_events":[{"introduced":"0.7.2.6"},{"last_affected":"0.7.2.6"}],"source":"CPE_STRING"}}],"versions":["0.7.2.6","v0.7.2.6-pre-sync-fix","v0.7.2.6-link-notes"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28101.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/turtl/desktop","events":[{"introduced":"629a50eeec4eb99909b217e1ee5916250edba6a2"},{"last_affected":"629a50eeec4eb99909b217e1ee5916250edba6a2"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:lyonbros:turtl:0.7.2.6:*:*:*:-:android:*:*","cpe:2.3:a:lyonbros:turtl:0.7.2.6:*:*:*:-:ios:*:*"],"extracted_events":[{"introduced":"0.7.2.6"},{"last_affected":"0.7.2.6"}]}}],"versions":["0.7.2.6","v0.7.3","v0.7.2.6-sqlite-fix","v0.7.2.6-pre-sync-fix","v0.7.2.6-link-notes","v0.7.2.6-error-reporting"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28101.json"}}],"schema_version":"1.9.0"}