Obsidian does not require user confirmation for non-http/https URLs.

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-38148 · ADVISORY
• obsidianmd/obsidian-api · PACKAGE
• web.archive.org/web/20210807011714/https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564 · WEB
• forum.obsidian.md/t/obsidian-release-v0-12-12/21564 · Release Notes

obsidian のその他の脆弱性

• CVE-2023-2110高 7.1Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfil…
• CVE-2023-33244高 8.2Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web p…
• CVE-2023-27035高 7.5An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified …
• CVE-2022-36450緊急 9.8Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki…