Vulnpedia
← Search CVEs

CVE-2026-77361

MEDIUM 4.7

Published 2026-10-13 · Last modified 2026-10-16

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.1%chance of exploitation in 30 days · 1st percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

4.7CVSS 3.1 · MEDIUM

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors The 40 Thieves

Products Obsidian Tc

Weakness (CWE)

  • CWE-59: : Improper Link Resolution Before File Access ('Link Following')
  • CWE-863: : Incorrect Authorization

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • obsidian-tc npm

    pkg:npm/obsidian-tc

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.3.1
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-c5xx-h28h-f682/GHSA-c5xx-h28h-f682.json"
  }
}
    GitHub Advisory Database · GHSA-c5xx-h28h-f682 · Updated 2026-10-23T17:45:03.921444112Z

All CVSS metrics

  • MEDIUM 4.7 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
  • MEDIUM 4.7 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS