https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 21:20:28 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-77362 <p>obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller&#39;s read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.</p> <p>obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller&#39;s read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.</p> https://db.gcve.eu/vuln/fkie_cve-2026-77362 https://db.gcve.eu/vuln/ghsa-43r2-c7g8-prc8 <p><strong>Affected:</strong> npm: obsidian-tc</p> <p>### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.</p> <p>### Patches Fixed in **1.3.1**. Upgrade to `&gt;= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.</p> <p>### Workarounds Disable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.</p> <p><strong>Affected:</strong> npm: obsidian-tc</p> <p>### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.</p> <p>### Patches Fixed in **1.3.1**. Upgrade to `&gt;= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.</p> <p>### Workarounds Disable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.</p> https://db.gcve.eu/vuln/ghsa-43r2-c7g8-prc8