Medium severity6.8OSV Advisory· Published Sep 5, 2025· Updated Apr 15, 2026

CVE-2025-58401

Description

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pierrad/Obsidian Github CopilotOSV2 versions
1.0.0, 1.0.1, 1.0.10, …+ 1 more
- (no CPE)range: 1.0.0, 1.0.1, 1.0.10, …
- (no CPE)range: <1.1.7

Patches

Vulnerability mechanics

References

github.com/Pierrad/obsidian-github-copilot/releases/tag/1.1.7nvd
jvn.jp/en/jp/JVN41633999/nvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000