Obsidian does not require user confirmation for non-http/https URLs. · CVE-2021-38148 · GitHub Advisory Database · GitHub

Obsidian does not require user confirmation for non-http/https URLs.

Critical severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Apr 22, 2024

Package

obsidian (npm)

Affected versions

< 0.12.12

Patched versions

0.12.12

Description

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.

References

Published by the National Vulnerability Database

Aug 7, 2021

Published to the GitHub Advisory Database May 24, 2022

Last updated Apr 22, 2024

Reviewed Apr 22, 2024

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H