high7.8
CVE-2021-42057
Obsidian Dataview vulnerable to code injection due to unsafe eval
Impact
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The `evalInContext` function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | obsidian-dataview | <= 0.4.12-hotfix1 | 0.4.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Obsidian | Obsidian Dataview | through 0.4.11 Version 0.4.12 |