What is the CVSS score of CVE-2024-55630?

CVE-2024-55630 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Joplin are affected by CVE-2024-55630?

CVE-2024-55630 is a low-severity vulnerability in Joplin involving input validation (CVSS 3.3).. A patch is available.

Is there a public PoC exploit available for CVE-2024-55630?

Yes, a public proof-of-concept exploit is available for CVE-2024-55630. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-55630?

During next maintenance window: Apply vendor patches when convenient. Verify input validation controls are in place.

Joplin CVE-2024-55630

LOW

Improper Input Validation (CWE-20)

2025-02-07 security-advisories@github.com

Denial Of Service Joplin Joplin Project

3.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:25 vuln.today

Patch released

Mar 28, 2026 - 18:25 nvd

Patch available

PoC Detected

Apr 18, 2025 - 02:10 vuln.today

Public exploit code

CVE Published

Feb 07, 2025 - 23:15 nvd

LOW 3.3

DescriptionGitHub Advisory

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property (e.g. querySelector), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

AnalysisAI

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-20. Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property (e.g. querySelector), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Joplin Project Joplin. Version information: version 3.2.8.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.