CVE-2022-36450: 
NixOS vulnerability analysis and mitigation

Obsidian versions 0.14.x and 0.15.x before 0.15.5 contained a remote code execution vulnerability through the obsidian:// URI scheme. The vulnerability was identified in July 2022 and tracked as CVE-2022-36450. The issue affected the note management software's handling of the hook-get-address functionality (Obsidian Forum, CHT Security).

The vulnerability stems from improper input validation where Obsidian would use window.open to open any provided URI without proper validation when receiving a hook-get-address action. This implementation flaw could allow execution of arbitrary commands through specially crafted URIs (Obsidian Forum).

An attacker could exploit this vulnerability to execute arbitrary remote programs on the target system, potentially leading to remote code execution. The attack could be initiated through malicious HTML files containing specially crafted iframe tags pointing to obsidian:// URIs (CHT Security).

The vulnerability was addressed in Obsidian version 0.15.5, which implemented better handling of the URI scheme. Users should upgrade to version 0.15.5 or later to protect against this vulnerability (Obsidian Forum).