Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

obsidian-tc tokens can access arbitrary configured vaults

Fix availableCritical · CVSS 9.9EPSS 0.31%

Published Oct 23, 2026 · updated Oct 23, 2026

What to do

  1. Upgrade to a fixed version: obsidian-tc 1.3.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmobsidian-tc987 downloads/week

Vulnerable versions
< 1.3.1
Fixed in
1.3.1

Check your project: npm ls obsidian-tc --all

Is obsidian-tc@1.3.1 safe to install? See the upgrade verdict →

What changed

  1. Oct 23, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-639 Authorization Bypass Through User-Controlled Key · CWE-863 Incorrect Authorization

← All critical vulnerabilities