npmPackage

obsidian-tc

7 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 1.34.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 1.34.0 (Nov 3, 2026), the latest release
Advisories: 7 · 1 critical, 3 high, 3 medium

Weekly downloads: 3,364
Dependents: 0
Releases: 68 since 0.0.1 (May 18, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-115478
Affects 1.0.1 to 1.31.3 (1.31.4 is outside it)
CVE-2026-115477
Affects 1.13.0 to 1.31.3 (1.31.4 is outside it)
CVE-2026-77361
Affects 0.0.1 to 1.2.1 (1.3.1 is outside it)
CVE-2026-77362
Affects 0.0.1 to 1.2.1 (1.3.1 is outside it)
CVE-2026-77366
Affects 0.0.1 to 1.2.1 (1.3.1 is outside it)
CVE-2026-77364
Affects 0.0.1 to 1.2.1 (1.3.1 is outside it)
CVE-2026-77363
Affects 0.0.1 to 1.2.1 (1.3.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-115478High 7.1
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
Affected: from 1.0.1, fixed in 1.31.4.
Fixed in 1.31.4 (released Sep 26, 2026, 27 days before disclosure).
The latest release, 1.34.0, is not affected.
48% of obsidian-tc downloads last week were affected versions (742).
CVE-2026-115477High 7.1
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
Affected: from 1.13.0, fixed in 1.31.4.
Fixed in 1.31.4 (released Sep 26, 2026, 27 days before disclosure).
The latest release, 1.34.0, is not affected.
20% of obsidian-tc downloads last week were affected versions (317).
CVE-2026-77361Medium 4.7
obsidian-tc symlink path mismatch bypasses read ACL restrictions
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Jul 3, 2026, 102 days before disclosure).
The latest release, 1.34.0, is not affected.
24% of obsidian-tc downloads last week were affected versions (372).
CVE-2026-77362Medium 4.3
obsidian-tc bridge tools expose data outside the read ACL
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Jul 3, 2026, 102 days before disclosure).
The latest release, 1.34.0, is not affected.
24% of obsidian-tc downloads last week were affected versions (372).
CVE-2026-77366Critical 9.9
obsidian-tc tokens can access arbitrary configured vaults
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure).
The latest release, 1.34.0, is not affected.
24% of obsidian-tc downloads last week were affected versions (372).
CVE-2026-77364Medium 6.5
obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure).
The latest release, 1.34.0, is not affected.
24% of obsidian-tc downloads last week were affected versions (372).
CVE-2026-77363High 8.8
obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure).
The latest release, 1.34.0, is not affected.
24% of obsidian-tc downloads last week were affected versions (372).