Description
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.
Published: 2026-10-08
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via MathJax filter bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Obsidian Desktop prior to version 1.14.0 exploits a bypass of the MathJax safe filter. By embedding a crafted \href value containing a TAB byte, the filterUrl function produces an empty protocol, allowing a javascript: URL anchor to be rendered. When a user clicks this anchor in Live Preview, the desktop’s Node‑integration‑enabled vault renderer invokes require('child_process'), enabling arbitrary operating system command execution as the desktop user. This code injection flaw aligns with CWE‑1188 and is also a form of reflected cross‑site scripting per CWE‑79.

Affected Systems

All installations of Obsidian Desktop with a version earlier than 1.14.0 are impacted. The affected product is Obsidian Desktop provided by Obsidian. Users of any older releases should consider upgrading to mitigate the risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the victim to open a note containing the crafted MathJax formula and click the resulting javascript: link, meaning the attack vector is user‑initiated within the local desktop environment. Given the high severity and the ability to execute arbitrary commands, the risk to affected users is significant.

Generated by OpenCVE AI on October 8, 2026 at 18:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Obsidian Desktop to version 1.14.4 or later, which removes the safe filter bypass in MathJax.
  • If possible, disable Node‑integration in the vault renderer to prevent child_process execution from malicious content.
  • Remove or sanitize any existing MathJax formulas that may contain \href links with non‑standard protocols to reduce the chance of accidental execution.

Generated by OpenCVE AI on October 8, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.
Title Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
Weaknesses CWE-1188
CWE-79
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-08T17:58:14.614Z

Reserved: 2026-10-01T18:02:50.083Z

Link: CVE-2026-104078

cve-icon Vulnrichment

Updated: 2026-10-08T17:58:11.127Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T17:17:11.753

Modified: 2026-10-08T21:33:42.423

Link: CVE-2026-104078

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T19:00:07Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')