obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
Impact
With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.
Workarounds
Set an explicit readPaths/writePaths whitelist that excludes the control directories.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | obsidian-tc | < 1.3.1 | 1.3.1 |
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-cvp8-vvgf-69q4
- https://github.com/The-40-Thieves/obsidian-tc/pull/73
- https://github.com/The-40-Thieves/obsidian-tc/commit/74de320ddea855e1dec47d67beabe88491149dab
- https://github.com/The-40-Thieves/obsidian-tc
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77364
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-200, CWE-276- Platform
- npm
- Package
obsidian-tc- Disclosed
- 23.10.2026
- Updated
- 23.10.2026 21:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cvp8-vvgf-69q4 - CC BY 4.0
Vulnerability history: obsidian-tc
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- Medium 3
Disclosures per year
- 2026: 5
-
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.