obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
CVE-2026-115478
Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory/ / .md path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that (type, name), keeping only its frontmatter. Separately, several of these tools inserted or removed their SQLite row before the fallible filesystem step, so a refused note write could leave a relation gone, a retired status committed, or the wrong entity deleted. Details createentity and linkentities inserted the SQL row or relation before materialization. renameentity seeded the destination path with a direct atomic write that bypassed the ownership check, and for a status-only rename could commit a retired status with the note write refused. unlinkentities removed the relation row before discovering the source note's rematerialization would be refused. deleteentity's cascade could delete the target and its relations before a neighbour's note was found to be foreign. The…
Assessment
- CVSS
- 7.1 (v4.0)
- Severity
- High
- EPSS
- 0.00323% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- npm · obsidian-tc
- Weakness
- CWE-459, CWE-863
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
At the source
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-r3g7-r4hr-m258
- https://nvd.nist.gov/vuln/detail/CVE-2026-115478
- https://github.com/The-40-Thieves/obsidian-tc/pull/978
- https://github.com/The-40-Thieves/obsidian-tc/commit/99f7914ca0fbeed92e7c4d39cc8c3e5830dab133
- https://github.com/The-40-Thieves/obsidian-tc/blob/v1.31.4/CHANGELOG.md
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.31.4
- https://github.com/advisories/GHSA-r3g7-r4hr-m258
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-115478