CVE-2020-9038

This exploit demonstrates a Cross-Site Scripting (XSS) vulnerability in Joplin Desktop 1.0.184 and earlier, allowing arbitrary file reading via a malicious note. The PoC uses a base64-encoded JavaScript payload to exfiltrate file contents to an attacker-controlled server.

This repository contains a functional proof-of-concept for CVE-2020-9038, an XSS vulnerability in Joplin. The exploit.js file demonstrates how an attacker can read local files via a crafted JavaScript payload.