CVE-2026-77362

Summary

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Severity

medium

CVSS

4.3

EPSS

0.2% (p10)

CWE

CWE-200, CWE-863

Also known as

GHSA-43r2-c7g8-prc8

Published

2026-10-23

Updated

2026-10-23

Advisory details

Impact

Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed or fail-closed, and list_templates is gated on the read whitelist.

Workarounds

Disable the affected bridge tools (tasks_filter, makemd_query, list_templates) via tool visibility.

References

• https://github.com/advisories/GHSA-43r2-c7g8-prc8
• https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8
• https://nvd.nist.gov/vuln/detail/CVE-2026-77362
• https://github.com/The-40-Thieves/obsidian-tc/pull/75
• https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309
• https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1

Related advisories

• CVE-2026-77366 — critical · npm/obsidian-tc
• CVE-2026-115478 — high · npm/obsidian-tc
• CVE-2026-115477 — high · npm/obsidian-tc
• CVE-2026-77364 — medium · npm/obsidian-tc
• CVE-2026-77361 — medium · npm/obsidian-tc
• CVE-2026-57449 — high · npm/@actual-app/sync-server
• CVE-2026-55485 — high · PyPI/piccolo-admin
• CVE-2026-91981 — medium · Go/code.vikunja.io/api

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity