Is CVE-2026-115478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115478 being exploited in the wild.

How severe is CVE-2026-115478?

High severity, with a CVSS score of 4, published 23 October 2026.

Which products and versions are affected?

obsidian-tc (npm) >= 1.0.1, <= 1.31.3, SEMVER:introduced=1.0.1,fixed=1.31.4; Obsidian-Tc Contributors Obsidian-Tc 1.0.1 to 1.31.3.

How is CVE-2026-115478 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-115478?

Check whether you run obsidian-tc (npm) or Obsidian-Tc Contributors Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115478: obsidian-tc entity operations data loss through unserialized SQLite writes

Q: Is there a fix for CVE-2026-115478?

Yes. obsidian-tc (npm): upgrade to 1.31.4 or later. Until then: Enable snapshots-before-write through the restore_note feature to mitigate note overwrites for notes previously written through obsidian-tc; however, this does not address the risk of inconsistent vault state from partial operation failures. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115478 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-115478?

Check whether you run obsidian-tc (npm) or Obsidian-Tc Contributors Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115478 · Severity: high · CVSS 4 · Published 2026-10-23

obsidian-tc is a server that manages knowledge vaults for AI agents using Obsidian, a note-taking application. A flaw in how it writes entity data to disk can cause unintended overwrites of user notes or leave the vault in an inconsistent state if operations fail partway through. An authorized user could accidentally destroy vault contents while creating, renaming, or deleting entities, with recovery only possible if backups were enabled.

Technologies: obsidian-tc (npm). Vendors: npm.

Quick answers

Is CVE-2026-115478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115478 being exploited in the wild.
How severe is CVE-2026-115478?: High severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?: obsidian-tc (npm) >= 1.0.1, <= 1.31.3, SEMVER:introduced=1.0.1,fixed=1.31.4; Obsidian-Tc Contributors Obsidian-Tc 1.0.1 to 1.31.3.
Is there a fix for CVE-2026-115478?: Yes. obsidian-tc (npm): upgrade to 1.31.4 or later. Until then: Enable snapshots-before-write through the restore_note feature to mitigate note overwrites for notes previously written through obsidian-tc; however, this does not address the risk of inconsistent vault state from partial operation failures. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115478 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-115478?: Check whether you run obsidian-tc (npm) or Obsidian-Tc Contributors Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

obsidian-tc (npm): upgrade to 1.31.4 or later
```
npm install obsidian-tc@1.31.4
```

Enable snapshots-before-write through the restore_note feature to mitigate note overwrites for notes previously written through obsidian-tc; however, this does not address the risk of inconsistent vault state from partial operation failures.

Technical details

The vulnerability affects create_entity, link_entities, rename_entity, unlink_entities, and delete_entity operations, which fail to atomically serialize SQLite mutations with filesystem writes. Several operations write database rows before materializing or validating the corresponding files, allowing orphaned notes or foreign note body overwrites when names collide after sanitization. Additionally, ownership validation is skipped in rename_entity's destination path write. An authorized caller with memory-tool permissions can trigger unintended data loss without special exploit techniques.

Affected products

obsidian-tc contributors obsidian-tc 1.0.1 to 1.31.3

Identifiers

CVE-2026-115478
GHSA-r3g7-r4hr-m258

Timeline

2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.