7vulnerabilities
- Critical2 (28.6%)
- High2 (28.6%)
- Medium0 (0.0%)
- Moderate3 (42.9%)
- Low0 (0.0%)
obsidian-tc
Ecosystem: npm
Downloads: 7.28 K
- 2CriticalAffects 2 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- 7 vulnerabilities
- Critical: 2
- High: 2
- Medium: 0
- Moderate: 3
- Low: 0
Vulnerabilities (7)
Known vulnerabilities affecting obsidian-tc, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-43r2-c7g8-prc8 | Moderate | obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist. |
| GitHub (opens in a new tab) | |
| GHSA-737x-cwfr-5vvc | High | obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP### Summary On a Streamable HTTP deployment with `auth.jwtSecret` configured, serving a 2026-07-28-era client that declared `elicitation.form` support, a call to a dispatch-gated tool (`destructive: true`, or a scope with an HITL floor) that was offered an `inputRequired` confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval; the state is minted before the elicitation leg is ask |
| GitHub (opens in a new tab) | |
| GHSA-84c9-qqpq-2pq5 | Critical | obsidian-tc tokens can access arbitrary configured vaults### Impact Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.) ### Patches Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade |
| GitHub (opens in a new tab) | |
| GHSA-c5xx-h28h-f682 | Moderate | obsidian-tc : Symlink read-ACL scope bypass via lexical path checks### Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site. ### Workarounds Do not permit untrusted symlinks inside the vault. |
| GitHub (opens in a new tab) | |
| GHSA-cvp8-vvgf-69q4 | Moderate | obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default### Impact With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on |
| GitHub (opens in a new tab) | |
| GHSA-pqh8-4pj7-32xx | Critical | obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25). |
| GitHub (opens in a new tab) | |
| GHSA-r3g7-r4hr-m258 | High | obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes### Summary `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory note's body from SQLite at the computed `memory/<type>/<name>.md` path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that `(type, name)`, keeping only its frontmatter. Separately, several of these tools inserted or removed their SQLite row before the fallible filesystem step, |
| GitHub (opens in a new tab) |
- GHSA-43r2-c7g8-prc8Moderateobsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
< 1.3.1
### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.
CVE: CVE-2026-77362
- GHSA-737x-cwfr-5vvcHighobsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
>= 1.13.0, < 1.31.4
### Summary On a Streamable HTTP deployment with `auth.jwtSecret` configured, serving a 2026-07-28-era client that declared `elicitation.form` support, a call to a dispatch-gated tool (`destructive: true`, or a scope with an HITL floor) that was offered an `inputRequired` confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval; the state is minted before the elicitation leg is ask
CVE: CVE-2026-115477
- GHSA-84c9-qqpq-2pq5Criticalobsidian-tc tokens can access arbitrary configured vaults
< 1.3.1
### Impact Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.) ### Patches Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade
CVE: CVE-2026-77366
- GHSA-c5xx-h28h-f682Moderateobsidian-tc : Symlink read-ACL scope bypass via lexical path checks
< 1.3.1
### Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site. ### Workarounds Do not permit untrusted symlinks inside the vault.
CVE: CVE-2026-77361
- GHSA-cvp8-vvgf-69q4Moderateobsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
< 1.3.1
### Impact With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on
CVE: CVE-2026-77364
- GHSA-pqh8-4pj7-32xxCriticalobsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
< 1.3.1
### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).
CVE: CVE-2026-77363
- GHSA-r3g7-r4hr-m258Highobsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
>= 1.0.1, < 1.31.4
### Summary `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory note's body from SQLite at the computed `memory/<type>/<name>.md` path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that `(type, name)`, keeping only its frontmatter. Separately, several of these tools inserted or removed their SQLite row before the fallible filesystem step,
CVE: CVE-2026-115478