CVE-2026-104078: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Obsidian Obsidian Desktop

CVE-2026-104078 is a cross-site scripting vulnerability in Obsidian Desktop prior to version 1.14.0. The vulnerability arises from a filter bypass in the MathJax 3.2.2 Safe component's URL filtering mechanism. Specifically, a crafted \href attribute containing a TAB byte causes the filterURL function to produce an empty protocol, bypassing configured safeProtocols restrictions. This enables an attacker to craft a note with a malicious MathJax formula that renders as a javascript: URL anchor. When a user clicks this anchor in Live Preview mode, the embedded JavaScript executes in the Node-integration-enabled vault renderer context, allowing arbitrary operating system command execution as the desktop user via require('child_process').

Successful exploitation allows an attacker to execute arbitrary operating system commands on the victim's machine with the privileges of the desktop user running Obsidian. This can lead to full compromise of the user's environment. The vulnerability requires user interaction (clicking the malicious link) and local access to the note content. The CVSS 4.0 score is 8.4 (high severity), reflecting local attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

A fix is available in Obsidian Desktop version 1.14.0 and later. Users should upgrade to version 1.14.0 or newer to remediate this vulnerability. No other mitigation guidance is provided or required as the vulnerability is addressed by the official patch.