CVE-2021-42057
Published
CVSS v3
7.8
HIGH
CVSS v2
9.3
HIGH
Affected
1
PROJECT
Description
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.
A data index and query language over Markdown files, for https://obsidian.md/.
GitHub