CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...