---
id: "CVE-2026-77361"
kind: "vulnerability"
aliases: ["CVE-2026-77361", "GHSA-c5xx-h28h-f682"]
title: "obsidian-tc : Symlink read-ACL scope bypass via lexical path checks"
severity: "medium"
cvss: 4.7
epss: 0.001129999989643693
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "obsidian-tc", "fixed": ["1.3.1"], "affected": "< 1.3.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "cwe-59", "cwe-863", "mcp", "npm", "obsidian", "obsidian-tc"]
not_affected_if: ["below-1.3.1-unaffected-version", "no-acl-deny-rules", "no-untrusted-symlinks-in-vault"]
published_at: "2026-10-13T14:17:42+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c5xx-h28h-f682", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77361", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

obsidian-tc, an MCP server for Obsidian vaults, checks its read access rules against the vault-relative path but enforces containment on the resolved real path. A symlink inside an allowed folder that points into a denied folder passes the access check.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:obsidian-tc affected < 1.3.1 fixed 1.3.1

## How to check

npm ls obsidian-tc (affected below 1.3.1)
Review the vault for symlinks placed under allowed globs that resolve into denied folders: find <vault> -type l -ls

## Fix

Upgrade obsidian-tc to >= 1.3.1 (npm install obsidian-tc@^1.3.1).
Until then, do not allow untrusted symlinks inside the vault.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-c5xx-h28h-f682
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77361

## From the sources

### Impact
ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.

### Workarounds
Do not permit untrusted symlinks inside the vault.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_