EUVD-2026-95100

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CVE-2026-104077

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CVE-2026-104077 Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CVE-2026-104077

Obsidian Desktop versions before 1.14.0 are vulnerable to Remote Code Execution (RCE) via the Slides core plugin . The root cause is insufficient sanitization of the data-background-iframe attribute in Markdown notes, which allows attackers to bypass DOMPurify . This vulnerability is exploited wh...