CVE-2026-104077 Obsidian CVE debrief

Who should care

Users of Obsidian Desktop, particularly those who use the Slides core plugin and open Markdown notes from untrusted sources, should be aware of this vulnerability and take steps to mitigate it.

Why it matters

CVE-2026-104077 is a high-severity vulnerability in Obsidian Desktop that allows remote code execution via maliciously crafted Markdown notes. Defenders should prioritize updating to version 1.14.0 or later and reviewing Markdown notes to prevent exploitation. The vulnerability requires user interaction to exploit, but can lead to arbitrary operating system command execution.

• Remote code execution is possible when opening maliciously crafted Markdown notes
• Arbitrary operating system command execution can occur when the victim manually starts the presentation
• Defenders should prioritize updating Obsidian Desktop and reviewing Markdown notes to prevent exploitation
• Verification of affected versions and remediation efforts is necessary

Technical summary

The vulnerability exists due to insufficient sanitization of the data-background-iframe attribute in Markdown notes, allowing a javascript: URL to execute in the resulting background iframe and enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation. The vulnerability affects Obsidian Desktop before version 1.14.0 and is related to the Slides core plugin and the bundled Reveal.js 4.3.1. The exploit involves crafting malicious Markdown notes that bypass DOMPurify.

Defensive priority

High priority should be given to updating Obsidian Desktop to version 1.14.0 or later, as well as reviewing and sanitizing Markdown notes to prevent exploitation.

Recommended defensive actions

• Update Obsidian Desktop to version 1.14.0 or later
• Review and sanitize Markdown notes to prevent exploitation
• Monitor for suspicious activity and implement compensating controls as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to the product changelog and patch notes. The vulnerability exists in Obsidian Desktop before version 1.14.0 and is related to the Slides core plugin. The exploit involves crafting malicious Markdown notes that bypass DOMPurify and are processed by the bundled Reveal.js 4.3.1. This allows a javascript: URL to execute in the resulting background iframe, enabling arbitrary operating system command execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.