Code Injection Vulnerability in Obsidian Dataview
Summary
CVE-2021-42057: Obsidian Dataview vulnerable to code injection due to unsafe eval. Affects obsidian-dataview versions < 0.4.13. Fixed in 0.4.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Obsidian Dataview is an open-source plugin for the Obsidian note-taking app that allows users to create dynamic and interactive Markdown files. It provides a powerful query language and data manipulation capabilities. However, a vulnerability has been discovered in versions up to 0.4.12-hotfix1 that allows for code injection through the unsafe use of the evalInContext function. This vulnerability can be exploited by crafting malicious Markdown files that execute arbitrary code when opened.
Vulnerability Detail
The code injection vulnerability in Obsidian Dataview arises from the insecure use of the evalInContext function. This function executes user input without proper validation, allowing an attacker to inject and execute arbitrary code. The impact of this vulnerability can be severe, as it enables an attacker to execute commands on the victim's system, potentially leading to unauthorized access, data leakage, or remote code execution. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-94.
How To Fix
Minimum fixed version
0.4.13
This is the first release that contains the fix.
npm install obsidian-dataview@0.4.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to version 0.4.13 is not immediately feasible, a temporary workaround is to avoid opening untrusted Markdown files or files from unknown sources. Additionally, it is recommended to disable the Obsidian Dataview plugin until the package is updated to a secure version.
Conclusion
The code injection vulnerability in Obsidian Dataview exposes users to the risk of arbitrary code execution. It is crucial to update to version 0.4.13 or later to mitigate this vulnerability. If immediate updating is not possible, it is recommended to exercise caution when opening Markdown files and consider disabling the plugin until a secure version is available. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for obsidian-dataview →
FAQ
Obsidian Dataview is a plugin for the Obsidian note-taking app that allows users to create dynamic and interactive Markdown files. It provides advanced querying and data manipulation capabilities.
The code injection vulnerability in Obsidian Dataview is caused by the unsafe use of the evalInContext function, which executes user input without proper validation. This allows an attacker to inject and execute arbitrary code.
The code injection vulnerability in Obsidian Dataview can lead to unauthorized access, data leakage, or remote code execution. An attacker can execute arbitrary commands on the victim's system, potentially compromising sensitive information or gaining control over the system.
To fix the code injection vulnerability, it is recommended to update Obsidian Dataview to version 0.4.13 or later. This version includes a mitigation for the vulnerability. Alternatively, you can disable the Obsidian Dataview plugin until a secure version is available.
A temporary workaround for the code injection vulnerability is to avoid opening untrusted Markdown files or files from unknown sources. Additionally, disabling the Obsidian Dataview plugin can mitigate the risk until a secure version is installed.
