CVE-2025-58401 Information disclosure in Obsidian GitHub Copilot Plugin
An attacker can read the stored GitHub API token to perform unauthorized operations on the linked account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-58401?
CVE-2025-58401 is a medium-severity vulnerability in Pierre-Adrien Vasseur Obsidian GitHub Copilot Plugin, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.
Weakness: CWE-312
Which versions are affected by CVE-2025-58401?
How do I fix CVE-2025-58401?
No fix has been published for CVE-2025-58401 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-58401 being exploited?
There is no known exploitation of CVE-2025-58401 in the wild and no public exploit code.
Sources
Also known as GHSA-f3fr-83vx-7f8c.