CVE-2026-77364
Mở trang đầy đủCVSS 6.5 MEDIUM Lộ dữ liệu
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
Mô tả
Impact
With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.
Workarounds
Set an explicit readPaths/writePaths whitelist that excludes the control directories.
Điểm và phân loại
- CVSS
- 6.5 MEDIUM v3.1
- Nguồn điểm
- GitHub Advisory
- Mức độ (theo nguồn)
- MEDIUM
- EPSS
- 0.24%
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ảnh hưởng
| Package | Bản bị ảnh hưởng | Bản đã sửa |
|---|---|---|
npm obsidian-tc |
< 1.3.1 |
1.3.1
|
Vì sao bị lọc
- CVSS 6.5 < 8.0 và không thuộc CISA KEV
Loại tác động
- Lộ dữ liệu
- CWE-200
Tham khảo
- https://github.com/advisories/GHSA-cvp8-vvgf-69q4
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-cvp8-vvgf-69q4
- https://github.com/The-40-Thieves/obsidian-tc/pull/73
- https://github.com/The-40-Thieves/obsidian-tc/commit/74de320ddea855e1dec47d67beabe88491149dab
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77364