A vulnerability in obsidian-tc allowed destructive vault operations to execute even after a human explicitly declined confirmation, if a compliant but malfunctioning client or attacker-controlled client resubmitted with the same request state. The issue affected dispatch-gated tools on HTTP deployments with JWT authentication.
Occurred 28 July 2026 · Disclosed 23 October 2026 · Record updated 23 October 2026
Destructive vault operations (delete, cross-folder move, frontmatter replace, link rewrite) could be executed despite explicit human refusal of confirmation, compromising data integrity for affected deployments.
VulnerabilitiesA flaw in the npm package obsidian-tc meant a declined confirmation could still result in notes being deleted or rewritten, according to an advisory published on 23 October 2026.
23 Oct 2026
