obsidian-tc tokens can access arbitrary configured vaults

影響: npm:obsidian-tc < 1.3.1 → 1.3.1

Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.) Patches Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published…

GitHub Advisory Databaseで読む

2026/10/24 02:29、GitHub Advisory Databaseが「obsidian-tc tokens can access arbitrary configured vaults」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-77366。