CVEvulnerability
CVE-2023-27035
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-05-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-276
Description
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
Affected configurations
• obsidian obsidian 1.1.9
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 Exploit
- https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 Release Notes
- https://github.com/fivex3/CVE-2023-27035 Exploit, Third Party Advisory
- https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 Exploit
- https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 Release Notes
- https://github.com/fivex3/CVE-2023-27035 Exploit, Third Party Advisory