CVE-2026-104078
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.
| CWE | CWE-79 CWE-1188 |
| Vendor | obsidian |
| Product | obsidian desktop |
| Published | Oct 8, 2026 |
Get instant alerts for obsidian obsidian desktop
Be the first to know when new high vulnerabilities affecting obsidian obsidian desktop are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H