~ / search / GHSA-43r2-c7g8-prc8

GHSA-43r2-c7g8-prc8

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-77362

Packages

EcosystemPackageAffectedFixed in
npm obsidian-tc < 1.3.1 1.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist. ### Workarounds Disable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.

References

External links from the advisory. They lead to third-party sites.