PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104078 Obsidian CVE debrief

CVE-2026-104078 debrief based on the supplied source corpus. Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted href value with a TAB byte in the URL scheme. This vulnerability causes filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating as

Vendor
Obsidian
Product
Obsidian Desktop
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Users of Obsidian Desktop, especially those using versions before 1.14.0, should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 1.14.0 or later, reviewing and updating affected versions, and monitoring for suspicious activity. Operators, platform administrators, and security teams should review the vulnerability details and assess their exposure to ensure prompt mitigation.

Why it matters

CVE-2026-104078 is a high-severity vulnerability in Obsidian Desktop that allows attackers to execute arbitrary code. Users should upgrade to version 1.14.0 or later and review affected versions.

  • Arbitrary code execution as the desktop user
  • Potential for malicious note exploitation
  • Need for version verification and updates

Technical summary

The vulnerability in Obsidian Desktop before 1.14.0 allows attackers to execute arbitrary code via a crafted MathJax formula. The vulnerability is caused by a filter bypass in the bundled MathJax 3.2.2 Safe component. This filter bypass allows attackers to craft a malicious MathJax formula that can be used to execute arbitrary code when clicked by the victim in Live Preview. The vulnerability has a CVSS score of 8.4 and is classified as HIGH severity. The official CVE Program record and NIST NVD detail page provide additional technical context.

Defensive priority

High priority for Obsidian Desktop users

Recommended defensive actions

  • Upgrade Obsidian Desktop to version 1.14.0 or later
  • Review and update affected versions
  • Monitor for suspicious activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Obsidian Desktop before 1.14.0. The vulnerability allows attackers to execute arbitrary code via a crafted MathJax formula. The CVE record was published on 2026-10-08T16:38:20.154Z and has not been modified since then. There are no explicit details on the affected scope or severity beyond the CVSS score of 8.4 and HIGH severity. The official CVE Program record and NIST NVD detail page provide additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104078 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104078

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104078 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104078

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.