{"id":"ghsa-ghsa-r3g7-r4hr-m258","seq":545629,"kind":"advisory","title":"obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes","url":"https://github.com/advisories/GHSA-r3g7-r4hr-m258","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r3g7-r4hr-m258","summary":"影響: npm:obsidian-tc >= 1.0.1, <= 1.31.3 → 1.31.4\ncreate_entity, link_entities, rename_entity, unlink_entities and delete_entity regenerate a memory note's body from SQLite at the computed memory/ / .md path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that (type, name), keeping only its frontmatter. Separately, several of these tools inserted…","severity":"high","techs":["nodejs","sqlite"],"cves":["CVE-2026-115478"],"tags":["GHSA-r3g7-r4hr-m258","obsidian-tc"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T18:47:25.000Z","fetched_at":"2026-10-23T18:50:52.525Z"}