Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-104078Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass

High 7.8

In plain English

A high-severity cross-site scripting in Obsidian Desktop from Obsidian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 93.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.

Affected products (as reported)

Vendor	Product	Versions
Obsidian	Obsidian Desktop	0 – before 1.14.0

Weakness: CWE-79, CWE-1188 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Product Changelog release-notes, patch
CodeAnt AI Blog technical-description, exploit
VulnCheck Advisory: Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass third-party-advisory