High severity8.0NVD Advisory· Published Jul 25, 2022· Updated Jun 17, 2026

CVE-2022-36450

Description

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Obsidian/Obsidian2 versions
cpe:2.3:a:obsidian:obsidian:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:obsidian:obsidian:*:*:*:*:*:*:*:*range: >=0.14.0,<0.15.5
- (no CPE)
Obsidian/Obsidian Canvasllm-fuzzy
Range: <0.15.5

Patches

Vulnerability mechanics

References

forum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743nvdExploitVendor Advisory
www.chtsecurity.com/news/f2a1ad21-3442-495f-8b6e-f0fe433d6caanvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.016
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000