Obsidian

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Obsidian records in CISA KEV

No Obsidian vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Obsidian 5 records HIGH Obsidian Dataview 1 record LOW

Records

5 records in Obsidian · all components

TI-2023-11881 CVE-2023-27035 · GHSA-3mrx-4wfm-g48p

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop…

HIGH 72

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01838 Published 2023-05-01 No fix listed CWE-276

TI-2023-01985 CVE-2023-2110 · GHSA-gpj7-f5cp-g2m9

Obsidian Local File Disclosure

HIGH 71

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>".

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.00361 Published 2023-08-19 Fixed in 1.2.8 CWE-22

TI-2022-16774 CVE-2022-36450 · GHSA-j67c-x57p-7jqm

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code…

MEDIUM 61

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20573 Published 2022-07-25 No fix listed CWE-20

TI-2021-15828 CVE-2021-38148 · GHSA-45mx-g85m-wwm3

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.

MEDIUM 45

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01225 Published 2021-08-07 Fixed in 0.12.12 CWE-285

TI-2023-16416 CVE-2023-33244 · GHSA-9w8g-4mjw-jw3p

Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera…

MEDIUM 42

Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00474 Published 2023-05-20 No fix listed

Open these records in search →

Critical	2
High	6
Medium	0
Low	0
No CVSS	0