CVE-2022-36450

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-25 · updated 2026-06-17
Weakness: CWE-20

Description

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

Affected products

Obsidian: from 0.14.0 before 0.15.5 — fixed in 0.15.5

How to fix

Upgrade to a fixed version: Obsidian 0.15.5. Check the vendor advisory for mitigations.

References

https://forum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743
https://www.chtsecurity.com/news/f2a1ad21-3442-495f-8b6e-f0fe433d6caa
https://forum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743
https://www.chtsecurity.com/news/f2a1ad21-3442-495f-8b6e-f0fe433d6caa

Get alerted when CVE-2022-36450 or the next vulnerability affects your stack