{"id":"CVE-2020-9038","aliases":["GHSA-6r7x-hc8m-985r"],"url":"https://o3.security/vulnerability/CVE-2020-9038","summary":"Cross-site Scripting in Joplin","details":"Joplin through 1.0.184 allows Arbitrary File Read via XSS.","published":"2020-02-17T16:15:28.867Z","modified":"2026-08-07T17:27:57.795563Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"joplin","fixedVersion":"1.2.1"}],"fix":{"url":"https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc","label":"laurent22/joplin@3db47b5"},"references":[{"type":"FIX","url":"https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc"},{"type":"FIX","url":"https://github.com/laurent22/joplin/compare/clipper-1.0.19...clipper-1.0.20"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/156582/Joplin-Desktop-1.0.184-Cross-Site-Scripting.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T17:27:57.795563Z"}}