CVE-2023-2110

CVSS V2 None CVSS V3 None
Description
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.
Overview
  • CVE ID
  • CVE-2023-2110
  • Assigner
  • STAR_Labs
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-08-19T05:31:48.974Z
  • Last Modified Date
  • 2023-08-19T05:31:48.974Z
References
Reference URL Reference Tags
https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/ release-notes
https://starlabs.sg/advisories/23/23-2110/ third-party-advisory
History
Created Old Value New Value Data Type Notes
2024-06-24 22:03:24 Added to TrackCVE