CVE-2026-77362
Mở trang đầy đủCVSS 4.3 MEDIUM Truy cập trái phép Lộ dữ liệu
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
Mô tả
Impact
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed or fail-closed, and list_templates is gated on the read whitelist.
Workarounds
Disable the affected bridge tools (tasks_filter, makemd_query, list_templates) via tool visibility.
Điểm và phân loại
- CVSS
- 4.3 MEDIUM v3.1
- Nguồn điểm
- GitHub Advisory
- Mức độ (theo nguồn)
- MEDIUM
- EPSS
- 0.2%
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ảnh hưởng
| Package | Bản bị ảnh hưởng | Bản đã sửa |
|---|---|---|
npm obsidian-tc |
< 1.3.1 |
1.3.1
|
Vì sao bị lọc
- CVSS 4.3 < 8.0 và không thuộc CISA KEV
Loại tác động
- Truy cập trái phép
- CWE-863
- Lộ dữ liệu
- CWE-200
Tham khảo
- https://github.com/advisories/GHSA-43r2-c7g8-prc8
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8
- https://nvd.nist.gov/vuln/detail/CVE-2026-77362
- https://github.com/The-40-Thieves/obsidian-tc/pull/75
- https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1