AI agent vulnerability · Other MCP servers and tools

CVE-2026-77361: obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

mediumCVSS 3.1 4.7GHSA-c5xx-h28h-f682

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape. Patches Fixed in 1.3.1. Upgrade to = 1.3.1.

Published Oct 23, 2026

Affected packages

obsidian-tc

Ecosystem: npm
Affected: < 1.3.1
Fixed in: 1.3.1
Check: npm ls obsidian-tc

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.

Workarounds

Do not permit untrusted symlinks inside the vault.

Credited to suavecito585.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries