Vulnerability · Published Jul 25, 2022 · Assigned by mitre
CVE-2022-36450
High 8.0
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 20.6% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)20.6%top 2.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.