All vulnerabilities
CVE-2026-104078

Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass

Obsidian Obsidian Desktop
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.14.0Fixed versionCVE List
Published8 Oct 2026Updated 12 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.

Text from CVE List

Affected versions 1

  • Obsidian Desktopaffected: all versions before 1.14.0CVE List

References 3