CVE-2021-42057

HIGH

Obsidian Dataview <= 0.4.12-hotfix1 - Remote Code Execution via Markdown File

Title source: llm
STIX 2.1

Description

Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/blacksmithgu/obsidian-dataview/issues/615

Scores

CVSS v3 7.8
EPSS 0.0120
EPSS Percentile 64.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (3)
npm/obsidian-dataview 0 - 0.4.13npm
obsidian/obsidian_dataview 0.4.12 (2 CPE variants)
obsidian/obsidian_dataview < 0.4.11
Published Nov 04, 2021
Tracked Since Feb 18, 2026