critical9.8
CVE-2021-38148
Obsidian does not require user confirmation for non-http/https URLs.
Impact
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | obsidian | < 0.12.12 | 0.12.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Obsidian | Obsidian | before 0.12.12 |