obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
Impact
ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.
Workarounds
Do not permit untrusted symlinks inside the vault.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | obsidian-tc | < 1.3.1 | 1.3.1 |
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-c5xx-h28h-f682
- https://github.com/The-40-Thieves/obsidian-tc/pull/76
- https://github.com/The-40-Thieves/obsidian-tc/commit/c81d1687e2cfec98a0d8bc5038c029f41ea9c920
- https://github.com/The-40-Thieves/obsidian-tc
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77361
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-59, CWE-863- Platform
- npm
- Package
obsidian-tc- Disclosed
- 23.10.2026
- Updated
- 23.10.2026 21:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-c5xx-h28h-f682 - CC BY 4.0
Vulnerability history: obsidian-tc
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- Medium 3
Disclosures per year
- 2026: 5
-
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.