CVE-2020-9038: 
JavaScript vulnerability analysis and mitigation

Joplin through version 1.0.184 contained a Cross-Site Scripting (XSS) vulnerability that allowed arbitrary file read operations. The vulnerability was disclosed on February 17, 2020, and was assigned identifier CVE-2020-9038. The issue affected the Joplin note-taking application up to and including version 1.0.184 (NVD).

The vulnerability was classified with a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability was identified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue allowed attackers to perform arbitrary file read operations through a cross-site scripting attack vector (NVD).

The vulnerability could allow attackers to read arbitrary files on the system through XSS exploitation. This could potentially lead to unauthorized access to sensitive information stored in files accessible to the Joplin application (NVD).

The vulnerability was patched in a subsequent release. Users were advised to upgrade to a version newer than 1.0.184. The fix was implemented through a code commit that addressed the XSS vulnerability (GitHub Commit).