obsidian-tc tokens can access arbitrary configured vaults

影響: npm:obsidian-tc < 1.3.1 → 1.3.1

Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.) Patches Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published…

在 GitHub Advisory Database 阅读

2026/10/24 02:29，GitHub Advisory Database 发布了“obsidian-tc tokens can access arbitrary configured vaults”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：JavaScript / Node.js。CVE：CVE-2026-77366。