Obsidian

8 CVEs across 3 Obsidian products. Browse Obsidian vulnerabilities, severities, and proof-of-concept exploits.

Obsidian products with known CVEs

ProductCVEs
Obsidian5
Obsidian Desktop2
Obsidian Dataview1
Obsidian CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-104078High7.82026-10-08Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary co…
CVE-2026-104077High7.82026-10-08Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient s…
CVE-2023-2110High8.22023-08-19Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remot…
CVE-2023-33244High8.22023-05-20Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.
CVE-2023-27035Medium6.52023-05-01An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedde…
CVE-2022-36450High8.02022-07-25Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.
CVE-2021-42057High7.82021-11-04Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious…
CVE-2021-38148Critical9.82021-08-07Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.