obsidian-tc
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 7 advisory(ies) without a verdict
Advisories (7)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-43r2-c7g8-prc8 obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields | < 1.3.1 | Undetermined |
| GHSA-737x-cwfr-5vvc obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP | 1.13.0 – < 1.31.4 | Undetermined |
| GHSA-84c9-qqpq-2pq5 obsidian-tc tokens can access arbitrary configured vaults | < 1.3.1 | Undetermined |
| GHSA-c5xx-h28h-f682 obsidian-tc : Symlink read-ACL scope bypass via lexical path checks | < 1.3.1 | Undetermined |
| GHSA-cvp8-vvgf-69q4 obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default | < 1.3.1 | Undetermined |
| GHSA-pqh8-4pj7-32xx obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback | < 1.3.1 | Undetermined |
| GHSA-r3g7-r4hr-m258 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes | 1.0.1 – < 1.31.4 | Undetermined |
Sources
| Source | Licence |
|---|