81 matches found
CVE-2026-104078
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...
EUVD-2026-95101
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...
CVE-2026-104078
Obsidian Desktop versions prior to 1.14.0 are vulnerable to Remote Code Execution (RCE) due to a filter bypass in the bundled MathJax 3.2.2 Safe component. The root cause is a failure in filterURL when processing a crafted rau value containing a TAB byte , which results in an empty protocol and b...
CVE-2026-104078 Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...
CVE-2026-104078: Improper Neutralization of Input During Web Page Generation
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...
PT-2026-108043
Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description A filter bypass exists in the bundled MathJax 3.2.2 Safe component. An attacker can execute arbitrary code by embedding a crafted href value containing a TAB byte in the URL scheme. This...
iga (1.3.0), labext-pkg (2.3.1) +2 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.8.1)
pymdown-extensions PYPI version 10.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - iga 1.3.0 - labext-pkg 2.3.1 - markdown-live-preview =0.2.67, =12.0.25, =12.0.26 Source cves: CVE-2026-67422 Source advisor...
arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.5.0)
pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...
arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.7.0)
pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...
edubotics-core (>=0.1.3, <=0.1.7), lexical-workspace (>=0.1.0, <=0.2.0) +5 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.9.0)
pymdown-extensions PYPI version 10.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - edubotics-core =0.1.3, =0.1.0, =12.0.27, =1.0.0, =1.0.0, =1.2.4 Source cves: CVE-2026-67422 Source advisory:...
iga (1.3.0), labext-pkg (2.3.1) +2 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.8.1)
pymdown-extensions PYPI version 10.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - iga 1.3.0 - labext-pkg 2.3.1 - markdown-live-preview =0.2.67, =12.0.25, =12.0.26 Source cves: CVE-2026-67422 Source advisor...
arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.7.0)
pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37...
arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.5.0)
pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37MW...
iga (1.3.0), labext-pkg (2.3.1) +2 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.8.1)
pymdown-extensions PYPI version 10.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - iga 1.3.0 - labext-pkg 2.3.1 - markdown-live-preview =0.2.67, =12.0.25, =12.0.26 Source cves: CVE-2026-61632 Source advisor...
edubotics-core (>=0.1.3, <=0.1.7), lexical-workspace (>=0.1.0, <=0.2.0) +5 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.9.0)
pymdown-extensions PYPI version 10.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - edubotics-core =0.1.3, =0.1.0, =12.0.27, =1.0.0, =1.0.0, =1.2.4 Source cves: CVE-2026-61632 Source advisory:...
arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.5.0)
pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-61632 Source advisory: OSV:PYSEC-2026-3609...
arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.7.0)
pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-61632 Source advisory: OSV:PYSEC-2026-3609...
arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.5.0)
pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...
arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.7.0)
pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JC...
edubotics-core (>=0.1.3, <=0.1.7), lexical-workspace (>=0.1.0, <=0.2.0) +5 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.9.0)
pymdown-extensions PYPI version 10.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - edubotics-core =0.1.3, =0.1.0, =12.0.27, =1.0.0, =1.0.0, =1.2.4 Source cves: CVE-2026-61632 Source advisory:...