Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-104078

CVE-2026-104078HIGH

Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   N   A   H   H   H    8.4   .0017    5.6     —

AFFECTED
  Product           Versions     Fixed
  Obsidian Desktop  unspecified  —

TIMELINE
  Oct 1   Reserved by VulnCheck
  Oct 8   Published (CNA: VulnCheck)
  Oct 12  EXPLOIT PUBLISHED — CVE-2026-104078 (Obsidian Desktop). Public exploit reference added.

CWE-79, CWE-1188 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Awaiting Analysis

Description

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 1, 2026	Reserved	Reserved by VulnCheck
October 8, 2026	Published	Published (CNA: VulnCheck)
October 12, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-104078 (Obsidian Desktop). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Obsidian	Obsidian Desktop	—	—	—

Weaknesses

CWE-79 · CWE-1188

References (3)

Authoritative record: CVE-2026-104078 at cve.org

Vendors: obsidian

Weaknesses: CWE-79 · CWE-1188

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-104078 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.