GHSA-cvp8-vvgf-69q4: Infoleak
Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.
Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.
Workarounds Set an explicit readPaths/writePaths whitelist that excludes the control directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/obsidian-tcto a version that resolves this vulnerability.Fixed in 1.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.1 - Configuration
Set explicit readPaths and writePaths whitelists that exclude the .obsidian, .git, and .trash control directories.
readPaths/writePaths = Explicit whitelist excluding .obsidian, .git, and .trash
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the default configuration are exposed because undefined readPaths and writePaths allowed all paths. The issue affects access to files within an Obsidian vault, including control directories.
What access does an attacker need to exploit it?
An attacker needs low-privileged access to make requests to the affected service. No user interaction is required, and they can directly request vault paths that were only blocked during directory enumeration.
What sensitive data could be obtained?
An attacker could read .obsidian/plugins/*/data.json files and exfiltrate plugin API keys and Obsidian Sync passwords. Other in-vault files could also be read by path.
How can the issue be mitigated if upgrading is not immediately possible?
Set explicit readPaths and writePaths whitelists that exclude .obsidian, .git, and .trash control directories. This avoids the allow-all behavior caused by undefined path settings.
What version fixes the issue?
Upgrade npm/obsidian-tc to version 1.3.1 or later. The fix denies the control directories for read, write, and delete operations and applies strictReadDefault on the request path.