diff --git a/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json b/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json
new file mode 100644
index 00000000000..9ea892bf924
--- /dev/null
+++ b/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json
@@ -0,0 +1,60 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-hff8-hjwv-j9q7",
+ "modified": "2024-11-14T17:38:14Z",
+ "published": "2024-11-14T17:38:14Z",
+ "aliases": [
+ "CVE-2024-49362"
+ ],
+ "summary": "Remote Code Execution on click of Link in markdown preview",
+ "details": "### Summary\n\nThere is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `` link within untrusted notes. The issue arises due to insufficient sanitization of `` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.\n\n### Details\n\nIn the markdown preview iframe, `Joplin` only opens `` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `` links from the `.md` file to prevent the execution of untrusted HTML content, it fails to sanitize the `data-from-md` attributes of `` tags introduced by `Mermaid` (e.g., the code snippet shown below). Since `Mermaid` allows the rendering of certain scriptless HTML elements, an attacker can embed ` `tags with `data-from-md` attributes, which will then be opened internally in the same Electron window.\n\nAdditionally, `Joplin` opens the window with `nodeIntegration` set to `true` and `contextIsolation` set to `false`, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the `sandbox` attribute, allowing scripts running in the iframe to call Node.js APIs through `window.parent`. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.\n\n\n**Relevant code references:**\n\n+ Payload to inject `` with `data-from-md` attribute:\n\n````markdown\n```mermaid\nflowchart TD\n A[hello]\n```\n````\n\n+ Handling link navigation in the markdown preview iframe\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116\n\n+ Window configuration of `Joplin` window\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155\n\n### PoC\n\nConsidering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: [GHSA-2h88-m32f-qh5m](https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5m) and [GHSA-g8qx-5vcm-3x59](https://github.com/laurent22/joplin/security/advisories/GHSA-g8qx-5vcm-3x59), where the malicious HTML file is available locally):\n\n+ `poc.md`\n````markdown\n```mermaid\nflowchart TD\n A[hello]\n```\n````\n\n+ `poc2.html`\n```\n\n \n \n \n\n```\n\nThen, open the `poc.md` with `Joplin` and click on the `hello` link. The code embedded in the `poc2.html` will be executed.\n\n\n\n### Impact\n\nThis vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "npm",
+ "name": "joplin"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "3.0"
+ },
+ {
+ "fixed": "3.1"
+ }
+ ]
+ }
+ ],
+ "versions": [
+ "3.0"
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/laurent22/joplin"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-94"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2024-11-14T17:38:14Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/11/GHSA-p2h2-3vg9-4p87/GHSA-p2h2-3vg9-4p87.json b/advisories/github-reviewed/2024/11/GHSA-p2h2-3vg9-4p87/GHSA-p2h2-3vg9-4p87.json
new file mode 100644
index 00000000000..dd4b4a6cd16
--- /dev/null
+++ b/advisories/github-reviewed/2024/11/GHSA-p2h2-3vg9-4p87/GHSA-p2h2-3vg9-4p87.json
@@ -0,0 +1,60 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p2h2-3vg9-4p87",
+ "modified": "2024-11-14T17:39:01Z",
+ "published": "2024-11-14T17:39:01Z",
+ "aliases": [
+ "CVE-2024-52308"
+ ],
+ "summary": "Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer",
+ "details": "### Summary\n\nA security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the `gh codespace ssh` or `gh codespace logs` commands.\n\n### Details\n\nThe vulnerability stems from the way GitHub CLI handles SSH connection details when executing commands. When developers connect to remote Codespaces, they typically use a SSH server running within a devcontainer, often provided through the [default devcontainer image](https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration). GitHub CLI [retrieves SSH connection details](https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244), such as remote username, which is used in [executing `ssh` commands](https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263) for `gh codespace ssh` or `gh codespace logs` commands.\n\nThis exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand=\"echo hacked\" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored.\n\nIn `2.62.0`, the remote username information is being validated before being used.\n\n### Impact\n\nSuccessful exploitation could lead to arbitrary code execution on the user's workstation, potentially compromising the user's data and system.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.62.0`\n2. Exercise caution when using custom devcontainer images, prefer default or pre-built devcontainers from trusted sources.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/cli/cli/v2"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.62.0"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 2.61.0"
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/cli/cli"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-77"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2024-11-14T17:39:01Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file