| Package | Affected versions | Patched versions |
|---|---|---|
| obsidian-tc | < 1.3.1 | 1.3.1 |
With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.
Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.
Set an explicit readPaths/writePaths whitelist that excludes the control directories.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free