obsidian-tc
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting obsidian-tcpage 1 of 1
- CVE-2026-115477HIGHCVSS 7.1EG 7.1fixed in 1.31.42026-10-23
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` s…
- CVE-2026-115478HIGHCVSS 7.1EG 7.1fixed in 1.31.42026-10-23
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite…
- CVE-2026-77361MEDIUMCVSS 4.7EG 4.7fixed in 1.3.12026-10-13
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault s…
- CVE-2026-77362MEDIUMCVSS 4.3EG 4.3fixed in 1.3.12026-10-13
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes grou…
- CVE-2026-77363CRITICALCVSS 8.8EG 9.6fixed in 1.3.12026-10-12
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loo…
- CVE-2026-77364MEDIUMCVSS 6.5EG 6.5fixed in 1.3.12026-10-12
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .…
- CVE-2026-77366CRITICALCVSS 9.9EG 9.9fixed in 1.3.12026-10-12
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) h…
Check whether obsidian-tc is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for obsidian-tc CVEs against the assets you own.
Book a Demo →