CVE-2026-104078: Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('childprocess'), achieving arbitrary operating system command execution as the desktop user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Obsidian Desktopto a version that resolves this vulnerability.Fixed in 1.14.0
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
An attacker must provide a note containing a crafted MathJax formula. The victim must render it in Live Preview and click the resulting malicious link.
What level of access does an attacker need?
The attacker does not need prior privileges on the victim's system. They need a way to get the victim to open a crafted note and click the rendered anchor.
What is the impact after successful exploitation?
The malicious link executes in the Node-integration-enabled vault renderer and can invoke require('child_process'). This allows arbitrary operating system command execution as the desktop user.
Which versions are affected?
Obsidian Desktop versions before 1.14.0 are affected, according to the vulnerability information.