Obsidian is a note-taking and personal-knowledge-management application with a focused product portfolio centered on local-file storage and markdown editing. Vulnerabilities affecting the vendor skew strongly toward critical severity and recur through weakness classes including code injection, input validation issues, path traversal, and improper permission handling—flaws that reflect the application's file-system access and plugin architecture. Defenders should treat this vendor's security advisories as high-priority given the severity profile; live exploitation activity and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Obsidian over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-36450CRITICAL Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. | Jul 25, 2022 | 9.8 | 41 | NO | NO |
CVE-2021-38148CRITICAL Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. | Aug 7, 2021 | 9.8 | 29 | NO | NO |
CVE-2023-33244HIGH Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. | May 20, 2023 | 8.2 | 26 | NO | NO |
CVE-2021-42057HIGH Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that w | Nov 4, 2021 | 7.8 | 26 | NO | NO |
CVE-2023-27035HIGH An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canv | May 1, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-2110HIGH Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "ap | Aug 19, 2023 | 7.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Obsidian.
Media articles that mention a CVE ID that affects a product developed by Obsidian — matched by CVE ID, not by vendor name.