CVE-2026-104078
Received Received - Intake

MathJax Filter Bypass in Obsidian Desktop

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-104078
EUVD
EUVD-2026-95101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Obsidian Obsidian Desktop 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Obsidian Desktop before 1.14.0 has a vulnerability where a filter bypass in the MathJax 3.2.2 Safe component allows attackers to execute arbitrary code. By embedding a crafted \href value with a TAB byte in the URL scheme, the filterURL function produces an empty protocol, bypassing safeProtocols restrictions. This enables a malicious MathJax formula to render as a javascript: URL anchor, which when clicked in Live Preview executes via Node integration, allowing OS command execution as the user.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary commands on your computer with the same permissions as your user account. This could lead to data theft, installation of malware, or unauthorized system access. The attack requires user interaction, such as clicking a malicious link in a note.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected Obsidian versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Obsidian Desktop to version 1.14.0 or later to address the MathJax filter bypass vulnerability. Disable Live Preview mode if not needed and avoid opening untrusted notes containing MathJax formulas.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104078. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart