CVE-2026-19331
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0, in the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed but has not responded.
Risk Assessment
A local attacker can access files outside the allowed directory, potentially leading to disclosure of sensitive data.
Recommendation
Monitor the project and apply patches when available. Restrict local access to the application.
Original NVD description (English source)
A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.