{"action":"Upgrade @joplin/onenote-converter to 3.5.7 or later.","affected":[{"fixed":"3.5.7","introduced":"0"}],"component":"@joplin/onenote-converter","cve_ids":["CVE-2026-22810"],"ecosystem":"npm","epss":0.00206,"exploited":false,"fixed_versions":["3.5.7"],"ghsa_id":"GHSA-gcmj-c9gg-9vh6","id":"tcs_01M5KFRBY80NBYRQ4J9WR1PKFX","modified_at":"2026-09-10T03:51:05.689991880Z","published_at":"2026-05-15T16:27:11Z","references":["https://osv.dev/vulnerability/GHSA-gcmj-c9gg-9vh6","https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6","https://nvd.nist.gov/vuln/detail/CVE-2026-22810","https://github.com/laurent22/joplin/pull/13736","https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c","https://github.com/laurent22/joplin","https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16","https://github.com/laurent22/joplin/releases/tag/v3.5.7"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-gcmj-c9gg-9vh6","url":"https://osv.dev/vulnerability/GHSA-gcmj-c9gg-9vh6"}],"summary":"@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files"}