Threat database

Obsidian Desktop versions before 1.14.0 contain a cross-site scripting (XSS) vulnerability in the bundled MathJax 3.2.2 Safe component. This vulnerability allows attackers to bypass URL filtering by embedding a crafted \href value containing a TAB byte, resulting in an empty protocol that circumvents safeProtocols restrictions. An attacker can craft a malicious MathJax formula that renders as a javascript: URL anchor. When clicked in Live Preview, this executes code in the Node-integration-enabled vault renderer, enabling arbitrary OS command execution as the desktop user.

Obsidian Desktop versions before 1.14.0 contain a high-severity remote code execution vulnerability. This flaw arises from insufficient sanitization of the data-background-iframe attribute in Markdown notes, which bypasses DOMPurify and is processed by Reveal.js 4.3.1 in the Slides core plugin. The vulnerability allows execution of javascript: URLs in the background iframe. Due to Node integration being enabled and context isolation disabled in the vault renderer, an attacker can execute arbitrary OS commands when a user opens the malicious note and starts the presentation.

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.