Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:obsidian-Tc_project:obsidian-Tc:*:*:*:*:*:node.js:*:*

1 brief RSS
critical advisory

obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

obsidian-tc +1 auth-bypass multi-tenancy web-application npm vulnerability file-overwrite data-corruption
3c