{"id":"ghsa-ghsa-43r2-c7g8-prc8","seq":544320,"kind":"advisory","title":"obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields","url":"https://github.com/advisories/GHSA-43r2-c7g8-prc8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-43r2-c7g8-prc8","summary":"影響: npm:obsidian-tc < 1.3.1 → 1.3.1\nBridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed o…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-77362"],"tags":["GHSA-43r2-c7g8-prc8","obsidian-tc"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T18:28:14.000Z","fetched_at":"2026-10-23T18:42:53.259Z"}