Obsidian Desktop: Code execution via Slides plugin Markdown notes
Summary
Obsidian Desktop contains a flaw in the Slides core plugin where a crafted Markdown note can inject a javascript: URL through the data-background-iframe attribute, which is then loaded by the bundled Reveal.js. The vault renderer runs with Node integration enabled and context isolation disabled, so injected script can access Node APIs and execute operating system commands with the privileges of the logged-in user. Exploitation requires that the victim opens the malicious note and manually starts the presentation.
Affected
- Obsidian Desktop versions before 1.14.0 (CNA record, VulnCheck)
- Some sources (VulDB) describe the range as up to 1.13.x; the exact range is not fully reconciled
- Mobile builds: Unknown.
Fixed in
- Obsidian Desktop 1.14.4 (vendor changelog dated October 5, 2026 lists a fix for a potential iframe injection in the Slides plugin)
- One secondary source lists 1.14.0 as the fix; this could not be confirmed against the vendor changelog.
Workaround
- No vendor-documented workaround.
- Interim measures (not vendor-confirmed): do not open or present Markdown notes from untrusted sources; consider disabling the Slides core plugin where presentations are not needed.
Exploitation
- Known exploited: No known exploitation according to the available sources; not listed in CISA KEV.
- EPSS: 0.00257 (low).
- A public write-up exists, but its content could not be verified.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory Obsidian Desktop versions across all workstations, including managed deployments.
- Update Obsidian Desktop to the latest release, at least 1.14.4, and verify the vendor changelog.
- Until patched, avoid opening or presenting untrusted notes and restrict the Slides plugin where not needed.
- Prioritise employees who open shared or externally sourced Markdown files.
- Re-check NVD for the final affected range, as analysis was pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: VulnCheck advisory www.vulncheck.com
- Obsidian Desktop changelog 1.14.4 obsidian.md
- CodeAnt security research write-up codeant.ai
- Vulners entry (NVD listing, CWE, EPSS) vulners.com
- VulDB entry vuldb.com
- HOL Guard CVE entry hol.org
- Reveal.js backgrounds documentation revealjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:08.
Original description (NVD)
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because Node integration is enabled and context isolation is disabled in Obsidian's vault renderer, the injected script can call parent.require() to access Node APIs such as fs and child_process, enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.