Executive brief
Obsidian Dataview is a popular plugin for the Obsidian note-taking application that enables dynamic data queries and rendering. The plugin improperly executes user-supplied code when processing Markdown files, allowing attackers to craft malicious documents that execute arbitrary code when opened by a user. This could lead to complete compromise of the user's system, theft of sensitive data, or installation of malware.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the evalInContext function that unsafely evaluates user input. An attacker can craft a malicious Markdown file containing specially crafted Dataview queries that, when opened in Obsidian, execute arbitrary JavaScript code with the privileges of the application. The attack requires user interaction (opening a malicious file) and works on all versions through 0.4.12-hotfix1. A mitigation was introduced in version 0.4.13, with a full fix available in later versions.
Affected products
- Obsidian Dataview <= 0.4.12-hotfix1
Timeline
- 2021-11-04: disclosed: CVE-2021-42057 published by NVD
- 2022-05-24: advisory: GHSA-xfg5-vrmc-24wc published
- 2021-11-04: patched: Mitigation released in version 0.4.13