Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Fix availableCritical · CVSS 9.6EPSS 0.16%

Published Oct 23, 2026 · updated Oct 23, 2026

What to do

  1. Upgrade to a fixed version: obsidian-tc 1.3.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmobsidian-tc987 downloads/week

Vulnerable versions
< 1.3.1
Fixed in
1.3.1

Check your project: npm ls obsidian-tc --all

Is obsidian-tc@1.3.1 safe to install? See the upgrade verdict →

What changed

  1. Oct 23, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-346 Origin Validation Error · CWE-1385 Missing Origin Validation in WebSockets

← All critical vulnerabilities