CVE-2025-58401

MEDIUM

Obsidian GitHub Copilot Plugin <1.1.7 - Info Disclosure

Title source: llm
STIX 2.1

Description

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.

References (2)

Scores

CVSS v3 6.8
EPSS 0.0001
EPSS Percentile 0.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-312
Status published
Products (1)
Pierre-Adrien Vasseur/Obsidian GitHub Copilot Plugin prior to 1.1.7
Published Sep 05, 2025
Tracked Since Feb 18, 2026