| Package | Affected versions | Patched versions |
|---|---|---|
| obsidian-tc | < 1.3.1 | 1.3.1 |
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.
Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed or fail-closed, and list_templates is gated on the read whitelist.
Disable the affected bridge tools (tasks_filter, makemd_query, list_templates) via tool visibility.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free