CVE-2024-49362

CVE-2024-49362 is a critical remote code execution (RCE) vulnerability affecting Joplin-desktop, a free and open-source note-taking application. The flaw allows arbitrary shell command execution when a user clicks on a malicious link within an untrusted note, stemming from insufficient sanitization of <a> tag attributes introduced by Mermaid. With a CVSS score of 9.6 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion, the potential for severe impact necessitates immediate patching.