CVE Watch12 de out. de 2026

CVE-2026-104077

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploi

CVSS

7.8

Alta

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Publicado: 8 de out. de 2026 · Última mod.: 12 de out. de 2026 · CWE-79 · CWE-1188

EPSS · 30d

0.3%EPSS · 30 dias0.3%

2026-10-092026-11-05

Descrição técnica

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because Node integration is enabled and context isolation is disabled in Obsidian's vault renderer, the injected script can call parent.require() to access Node APIs such as fs and child_process, enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-650226.3 MÉD

—

———The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.5h CVE-2026-397447.1 ALT

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.5h CVE-2026-1194887.1 ALT

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.5h CVE-2026-1194726.5 MÉD

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.5h CVE-2026-1194328.7 ALT

—

———A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.8h CVE-2026-889866.1 MÉD

—

———Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.15h