Is CVE-2025-24028 actively exploited?

No active exploitation of CVE-2025-24028 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-24028 be exploited remotely?

Yes. CVE-2025-24028 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-24028?

CVE-2025-24028 has a CVSS score of 9.6 (CRITICAL).

HOME VULNERABILITIESCVE-2025-24028

CRITICAL

CVE-2025-24028

CWE-79Published: February 7, 2025· Updated: Jun 17, 2026

9.6

CVSS v3.1

Official Description

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

NVD Source

Risk Analysis

Joplin is affected by a cross-site scripting (XSS) vulnerability due to improper handling of HTML comments in the Rich Text Editor. This allows attackers to execute malicious scripts when a user opens an untrusted note.

No public exploit is known, and it is not in the CISA KEV. The vulnerability is remotely exploitable and requires user interaction.

Recommended Action

All users are advised to upgrade to Joplin version 3.2.12 or later to address this security flaw.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-24028 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.6.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.