Description
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | obsidian | < 0.12.12 | 0.12.12 | GHSA-45mx-g85m-wwm3 |
Critical · 9.8
CVE-2021-38148
EUVD-2022-2308GHSA-45mx-g85m-wwm3
Obsidian does not require user confirmation for non-http/https URLs.
Published Aug 7, 2021 · Updated Aug 4, 2024 · Assigned by mitre