GCVE - cpe:2.3:a:obsidian:obsidian:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:obsidian:obsidian:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Obsidian (`a3f0a076-1cdf-5fb2-bc44-e82f6fc695cf`)
Product	Obsidian (`ed690970-e11b-5d6e-b465-6c7a0a710278`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/obsidianmd/obsidian-releases`	purl2cpe	2026-06-01 10:15:26.283552

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-33244`	vulnerable	2026-06-08 06:06:22.112944	Details available Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. Published: 2023-05-20T00:00:00.000Z Updated: 2025-01-31T17:28:33.685Z Open on db.gcve.eu Reference links https://vuln.ryotak.net/advisories/66 https://forum.obsidian.md/t/obsidian-release-v1-2-2-insider-build/57488	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2110`	vulnerable	2026-06-08 06:02:41.435839	Obsidian Local File Disclosure HIGH (8.2) Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian. Published: 2023-08-19T05:31:48.974Z Updated: 2024-10-07T20:02:00.230Z Open on db.gcve.eu Reference links https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/ https://starlabs.sg/advisories/23/23-2110/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36450`	vulnerable	2026-06-08 05:46:07.446298	Details available HIGH (8) Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. Published: 2022-07-25T06:15:49.000Z Updated: 2024-08-03T10:07:34.109Z Open on db.gcve.eu Reference links https://forum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743 https://www.chtsecurity.com/news/f2a1ad21-3442-495f-8b6e-f0fe433d6caa	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-38148`	vulnerable	2026-06-08 05:32:55.493436	Details available Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Published: 2021-08-07T02:28:49.000Z Updated: 2024-08-04T01:37:14.848Z Open on db.gcve.eu Reference links https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.