# obsidian-tc (npm) vulnerabilities 7 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.34.0 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 1.34.0 (Nov 3, 2026), the latest release - Weekly downloads: 3,364 - Dependents: 0 - Releases: 68 since 0.0.1 (May 18, 2026) - Registry: https://www.npmjs.com/package/obsidian-tc - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-115478: 1.0.1 to 1.31.3 (1.31.4 is outside it) - CVE-2026-115477: 1.13.0 to 1.31.3 (1.31.4 is outside it) - CVE-2026-77361: 0.0.1 to 1.2.1 (1.3.1 is outside it) - CVE-2026-77362: 0.0.1 to 1.2.1 (1.3.1 is outside it) - CVE-2026-77366: 0.0.1 to 1.2.1 (1.3.1 is outside it) - CVE-2026-77364: 0.0.1 to 1.2.1 (1.3.1 is outside it) - CVE-2026-77363: 0.0.1 to 1.2.1 (1.3.1 is outside it) ## Advisories (7) ### [CVE-2026-115478](https://cve.now/CVE-2026-115478): obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes - Severity: High 7.1 - Published: Oct 23, 2026 - Affected: from 1.0.1, fixed in 1.31.4. - Fixed in 1.31.4 (released Sep 26, 2026, 27 days before disclosure). - The latest release, 1.34.0, is not affected. - 48% of obsidian-tc downloads last week were affected versions (742). ### [CVE-2026-115477](https://cve.now/CVE-2026-115477): obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP - Severity: High 7.1 - Published: Oct 23, 2026 - Affected: from 1.13.0, fixed in 1.31.4. - Fixed in 1.31.4 (released Sep 26, 2026, 27 days before disclosure). - The latest release, 1.34.0, is not affected. - 20% of obsidian-tc downloads last week were affected versions (317). ### [CVE-2026-77361](https://cve.now/CVE-2026-77361): obsidian-tc symlink path mismatch bypasses read ACL restrictions - Severity: Medium 4.7 - Published: Oct 13, 2026 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jul 3, 2026, 102 days before disclosure). - The latest release, 1.34.0, is not affected. - 24% of obsidian-tc downloads last week were affected versions (372). ### [CVE-2026-77362](https://cve.now/CVE-2026-77362): obsidian-tc bridge tools expose data outside the read ACL - Severity: Medium 4.3 - Published: Oct 13, 2026 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jul 3, 2026, 102 days before disclosure). - The latest release, 1.34.0, is not affected. - 24% of obsidian-tc downloads last week were affected versions (372). ### [CVE-2026-77366](https://cve.now/CVE-2026-77366): obsidian-tc tokens can access arbitrary configured vaults - Severity: Critical 9.9 - Published: Oct 12, 2026 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure). - The latest release, 1.34.0, is not affected. - 24% of obsidian-tc downloads last week were affected versions (372). ### [CVE-2026-77364](https://cve.now/CVE-2026-77364): obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets - Severity: Medium 6.5 - Published: Oct 12, 2026 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure). - The latest release, 1.34.0, is not affected. - 24% of obsidian-tc downloads last week were affected versions (372). ### [CVE-2026-77363](https://cve.now/CVE-2026-77363): obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access - Severity: High 8.8 - Published: Oct 12, 2026 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jul 3, 2026, 101 days before disclosure). - The latest release, 1.34.0, is not affected. - 24% of obsidian-tc downloads last week were affected versions (372). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/obsidian-tc Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.