CVE-2026-104078

Obsidian Desktop versions prior to 1.14.0 are vulnerable to Remote Code Execution (RCE) due to a filter bypass in the bundled MathJax 3.2.2 Safe component. The root cause is a failure in filterURL when processing a crafted rau value containing a TAB byte , which results in an empty protocol and b...

CVE-2026-104078 Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...

EUVD-2026-95101

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...

CVE-2021-33041

vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require'childprocess'.execSync'calc.exe' on Windows and a similar attack on macOS...