obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

影響: npm:obsidian-tc < 1.3.1 → 1.3.1

Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed o…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 03:28, GitHub Advisory Database에서 "obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-77362.