{"id":"CVE-2026-104078","published":"2026-10-08T17:17:11.753","lastModified":"2026-10-12T21:17:08.157","description":"Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \\href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79","CWE-1188"],"vendors":[],"products":[],"references":[{"url":"https://codeant.ai/security-research/from-markdown-to-a-shell-obsidian-desktop-rce","tags":[]},{"url":"https://obsidian.md/changelog/2026-10-05-desktop-v1.14.4/","tags":[]},{"url":"https://www.vulncheck.com/advisories/obsidian-desktop-rce-via-mathjax-safe-filter-bypass","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Obsidian Desktop before 1.14.0 has a vulnerability where attackers can bypass URL filtering in MathJax to execute arbitrary OS commands through crafted notes with malicious MathJax formulas. This allows remote code execution as the desktop user.","exploitability":"Exploitation requires crafting a malicious note with a specific TAB-byte encoded URL in a MathJax formula, but once created, the attack is easily triggered when victims click on the rendered formula in Live Preview mode.","blast_radius":"The vulnerability affects all Obsidian Desktop users running versions before 1.14.0 who open malicious notes containing crafted MathJax formulas, potentially leading to full system compromise as the desktop user.","remediation":"Upgrade to Obsidian Desktop 1.14.0 or later to receive the patched MathJax component that fixes the URL filtering bypass.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","mathjax","desktop"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:03.612Z"}}