{"id":"CVE-2026-77362","aliases":["GHSA-43r2-c7g8-prc8"],"url":"https://o3.security/vulnerability/CVE-2026-77362","summary":"obsidian-tc bridge tools expose data outside the read ACL","details":"### Impact\nBridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.\n\n### Workarounds\nDisable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.","published":"2026-10-13T14:00:11.565Z","modified":"2026-10-24T02:30:30.743953347Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"obsidian-tc","fixedVersion":"1.3.1"}],"fix":{"url":"https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309","label":"The-40-Thieves/obsidian-tc@5ab2109"},"references":[{"type":"WEB","url":"https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77362.json"},{"type":"ADVISORY","url":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77362"},{"type":"FIX","url":"https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309"},{"type":"FIX","url":"https://github.com/The-40-Thieves/obsidian-tc/pull/75"},{"type":"PACKAGE","url":"https://github.com/The-40-Thieves/obsidian-tc"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:30:30.743953347Z"}}