CVE-2026-104077 in Obsidian
Summary
by MITRE • 10/08/2026
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because Node integration is enabled and context isolation is disabled in Obsidian's vault renderer, the injected script can call parent.require() to access Node APIs such as fs and child_process, enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Obsidian Desktop versions prior to 1.14.0 represents a critical security flaw within the Slides core plugin, specifically affecting the application's presentation mode functionality. This issue stems from an improper neutralization of special elements used in markup, commonly categorized under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting. The root cause lies in the interaction between the Markdown parsing engine and the DOMPurify sanitization library. While DOMPurify is designed to strip dangerous attributes from HTML content to prevent cross-site scripting attacks, it failed to adequately sanitize the data-background-iframe attribute when processed within the context of a presentation slide. This oversight allowed an attacker to inject malicious code that bypassed standard security filters by exploiting specific parsing behaviors unique to the Slides plugin's rendering logic.
The technical mechanism of this vulnerability relies on the ability to craft a Markdown note containing a specially constructed data-background-iframe attribute. When a victim opens such a note and initiates it as a presentation, the underlying Reveal.js library processes the slide content. Instead of treating the injected value merely as static background metadata, Reveal.js promotes the attacker-controlled string to become the source URL for an iframe element. Crucially, this process lacks sufficient validation regarding URL schemes. The application does not restrict the use of javascript: URIs or other dangerous protocols that can execute client-side scripts directly within the browser context. This lack of scheme restriction is a significant deviation from secure coding practices and aligns with CWE-798: Use of Hard-coded Credentials, in this case referring to the hard-coded trust placed in input data without proper validation of its protocol type.
The impact of this vulnerability extends far beyond typical cross-site scripting scenarios due to the architecture of Obsidian Desktop as an Electron-based application. The renderer process where Reveal.js operates is configured with context isolation disabled and has direct access to Node.js APIs through the parent.require function. This configuration, while potentially intended for plugin development flexibility, creates a severe security risk when combined with unsanitized input. By injecting a javascript: payload via the iframe src attribute, an attacker can execute arbitrary JavaScript code within this privileged renderer context. From there, the malicious script utilizes parent.require to access Node.js modules, effectively bridging the gap between untrusted web content and the operating system's command interpreter. This results in Arbitrary Code Execution (CWE-78), allowing the attacker to run commands with the same privileges as the user running Obsidian Desktop.
From a threat modeling perspective, this vulnerability maps directly to MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically through JavaScript execution within an Electron environment. It also reflects aspects of T1204: User Execution, as it requires the victim to open a malicious file or note and initiate the presentation mode. The ability to execute arbitrary commands means that attackers could potentially exfiltrate sensitive data stored locally by Obsidian, such as vault contents containing personal notes, passwords, or other confidential information. Furthermore, since the execution occurs under the user's identity, it opens avenues for lateral movement if the user has access to network resources or elevated privileges on their system.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to upgrade Obsidian Desktop to version 1.14.0 or later, where this specific sanitization bypass in the Slides plugin has been addressed by developers. For environments unable to update immediately, restricting the use of presentation modes for untrusted documents can reduce exposure. Additionally, from a development standpoint, it is imperative to enforce strict URL scheme validation on all dynamic iframe src attributes, explicitly blocking javascript:, data: (unless strictly necessary and sanitized), and other executable protocols. Enabling context isolation in Electron applications by default would also prevent renderer processes from accessing Node.js APIs directly via parent.require, thereby containing any potential script execution within the sandboxed web environment and preventing escalation to arbitrary command execution.