Obsidian
Monthly
Arbitrary operating-system command execution on Obsidian Desktop builds prior to 1.14.0 is possible when a victim opens an attacker-supplied note in Live Preview and clicks a malicious MathJax-rendered anchor. The flaw lives in the bundled MathJax 3.2.2 Safe component, whose filterURL mishandles a TAB byte embedded in a \href URL scheme, yielding an empty protocol that slips past the configured safeProtocols allowlist and renders a javascript: link; clicking it executes in the Node-integration-enabled renderer through require('child_process'), running commands as the desktop user. Exploitation is conditionally gated rather than a drive-by remote compromise: the attacker cannot act without the victim's click (UI:A / UI:R), the hostile note must first be delivered into the victim's vault (typically via a shared, synced, or downloaded vault or social engineering), and patched users or those with Node integration disabled are not affected; confirmed actively exploited status is not established - no public exploit identified at time of analysis - and the vendor patch is referenced in the desktop v1.14.4 changelog.
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
Unauthenticated OAuth handling in Obsidian Web MCP (obsidian-web-mcp) prior to 0.2.0 lets any remote caller who can reach the deployment obtain the static VAULT_MCP_TOKEN and then invoke vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire Obsidian vault. Because /oauth/authorize issues an authorization code with no login, consent, or session check, and /oauth/token exchanges that code for the bearer token without authenticating a client, the flaw carries a CVSS of 9.4 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and grants full read and write control of personal notes; optional PKCE does not stop an attacker-initiated flow, and /oauth/register additionally returns the configured VAULT_OAUTH_CLIENT_SECRET, exposing a client_credentials path. No CISA KEV listing is present and no public exploit identified at time of analysis - exploitation requires only that the server be network-reachable, which is realistic for instances published through the project's recommended Cloudflare Tunnel.
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary operating-system command execution on Obsidian Desktop builds prior to 1.14.0 is possible when a victim opens an attacker-supplied note in Live Preview and clicks a malicious MathJax-rendered anchor. The flaw lives in the bundled MathJax 3.2.2 Safe component, whose filterURL mishandles a TAB byte embedded in a \href URL scheme, yielding an empty protocol that slips past the configured safeProtocols allowlist and renders a javascript: link; clicking it executes in the Node-integration-enabled renderer through require('child_process'), running commands as the desktop user. Exploitation is conditionally gated rather than a drive-by remote compromise: the attacker cannot act without the victim's click (UI:A / UI:R), the hostile note must first be delivered into the victim's vault (typically via a shared, synced, or downloaded vault or social engineering), and patched users or those with Node integration disabled are not affected; confirmed actively exploited status is not established - no public exploit identified at time of analysis - and the vendor patch is referenced in the desktop v1.14.4 changelog.
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
Unauthenticated OAuth handling in Obsidian Web MCP (obsidian-web-mcp) prior to 0.2.0 lets any remote caller who can reach the deployment obtain the static VAULT_MCP_TOKEN and then invoke vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire Obsidian vault. Because /oauth/authorize issues an authorization code with no login, consent, or session check, and /oauth/token exchanges that code for the bearer token without authenticating a client, the flaw carries a CVSS of 9.4 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and grants full read and write control of personal notes; optional PKCE does not stop an attacker-initiated flow, and /oauth/register additionally returns the configured VAULT_OAUTH_CLIENT_SECRET, exposing a client_credentials path. No CISA KEV listing is present and no public exploit identified at time of analysis - exploitation requires only that the server be network-reachable, which is realistic for instances published through the project's recommended Cloudflare Tunnel.
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.