Obsidian Desktop CVE-2026-104077

Exploitation requires all of the following: the target runs an unpatched Obsidian Desktop build with the Slides core plugin available; the attacker delivers a Markdown note containing a data-background-iframe attribute whose value bypasses DOMPurify; and the victim both opens that note and explicitly starts it as a presentation, at which point Reveal.js promotes the value to an iframe src with no URL-scheme restriction. The underlying enabler is Obsidian's Electron configuration - Node integration enabled with context isolation disabled - which lets a javascript: payload reach parent.require and Node APIs. Limiting factors that reduce real-world risk: mandatory user interaction (opening the file plus manually launching the presentation), local file-based delivery rather than remote push, and dependence on a pre-fix (pre-1.14.x) build; updating removes the exposure.

This is a genuine high-priority issue despite relying on user interaction. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5 and the technical impact is full compromise (VC:H/VI:H/VA:H) because the flaw chains an XSS-class sanitization bypass (CWE-79) into arbitrary OS command execution in a Node-integrated, context-isolation-disabled Electron renderer. The decisive limiter is UI:P (passive/required user interaction): the victim must open the attacker's note AND actively start it as a presentation, and AV:L reflects that the payload arrives as a local file rather than over the network, so this is a social-engineering / malicious-file delivery problem rather than a wormable remote exploit. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation; the signals point to targeted, victim-triggered abuse. One data conflict to verify: the description states the fix is 'before 1.14.0' while the only reference is the vendor changelog for Desktop v1.14.4 - confirm the exact patched build with Obsidian. Only a CVSS 4.0 vector was supplied (no 3.1), and the reporter is VulnCheck.

An attacker shares a seemingly benign Markdown note (e.g., via a synced vault, shared folder, email, or community resource) that embeds a data-background-iframe attribute surviving DOMPurify. When the victim opens the note in Obsidian Desktop and starts it as a presentation with the Slides core plugin, Reveal.js promotes the attacker-controlled value into an iframe src without scheme restrictions, firing a javascript: payload that calls parent.require to reach Node.js APIs and run commands as the Obsidian user. No public exploit code was identified at time of analysis, but the technique is fully described.