Live › vulnerability › CVE-2026-77364
Go to dashboardobsidian-tc is an npm package whose default folder access rules fail open, so with default configuration any caller can read files by path, including .obsidian/plugins/*/data.json. An attacker can read plugin API keys and Obsidian Sync passwords, plus any other file in the vault.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| obsidian-tc | npm | < 1.3.1 | 1.3.1 |
npm ls obsidian-tc to see the installed version; below 1.3.1 is affected1.3.1, check whether readPaths and writePaths are explicitly set and exclude .obsidian, .git and .trash1.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.
Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.
Set an explicit readPaths/writePaths whitelist that excludes the control directories.
This page as .md · .json · in your agent: get_signal("CVE-2026-77364")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.