npm/obsidian CVE-2021-38148: critical 9.8, EPSS 1.23%
Obsidian does not require user confirmation for non-http/https URLs.
Action: Upgrade obsidian to 0.12.12 or later.
npm i obsidian@0.12.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.12 | - |
Fixed versions
| 0.12.12 |
Sources
- osv: GHSA-45mx-g85m-wwm3
- https://nvd.nist.gov/vuln/detail/CVE-2021-38148
- https://github.com/obsidianmd/obsidian-api
- https://web.archive.org/web/20210807011714/https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564
CVE-2021-38148 · published · modified · JSON