Tóm tắt nhanh
- CVE-2026-77362 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng obsidian-tc.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.20%, cao hơn 9.8% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.3.1 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| obsidian-tc npm | < 1.3.1
| 1.3.1
|
Mô tả
Impact
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed or fail-closed, and list_templates is gated on the read whitelist.
Workarounds
Disable the affected bridge tools (tasks_filter, makemd_query, list_templates) via tool visibility.
Mô tả của NVD
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí