| Package | Affected versions | Patched versions |
|---|---|---|
| obsidian | ≥ 0.14.0, < 0.15.5 | 0.15.5 |
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free