CVE-2021-38148

CVE-2021-38148 is a critical vulnerability affecting Obsidian versions prior to 0.12.12, where the application fails to require user confirmation for non-http/https URLs. This allows an attacker to execute arbitrary code or commands without user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating potential interest from threat actors.