Eval Injection Vulnerability in Obsidian Dataview by Blacksmithgu
CVE-2021-42057

7.8HIGH

Key Information:

Vendor

Obsidian

Status
Obsidian Dataview
Vendor
CVE Published:
4 November 2021

What is CVE-2021-42057?

The eval injection vulnerability in Obsidian Dataview allows attackers to execute arbitrary code by manipulating user input through the evalInContext function. This can be achieved by creating malicious Markdown files that run harmful code as soon as they are opened by users. A fix has been introduced in version 0.4.13, but previous versions remain susceptible to this risk, emphasizing the importance of updating to ensure user safety and data integrity.

References

https://github.com/blacksmithgu/obsidian-dataview/issues/615
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.