## obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-77362
- 公開日時: 2026-10-23T18:28:14.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-43r2-c7g8-prc8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-43r2-c7g8-prc8

影響: npm:obsidian-tc < 1.3.1 → 1.3.1
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed o…