CVE-2026-104077

Summary

Obsidian Desktop allows remote code execution through malicious Markdown notes that exploit insufficient sanitization of iframe attributes, enabling attackers to execute arbitrary OS commands when victims open vulnerable notes and start presentations.

Exploitability

Exploitation requires crafting a malicious Markdown note with a javascript: URL in the data-background-iframe attribute and convincing a victim to open it and manually start the presentation, making it moderately difficult but achievable.

Blast radius

The vulnerability affects all Obsidian Desktop users running versions before 1.14.0 who open malicious notes, potentially leading to full system compromise through arbitrary command execution.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Obsidian Desktop 1.14.0 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.