nd it also reads a cached copy of one vault file, to manage and govern tags. It makes outbound network requests. If configured to use external services, it can send vault content or related data to those services as part of its tag-curation workflow.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"form-data","packageVersion":">=4.0.0 <4.0.6","severity":"high","title":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","advisoryUrl":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","ghsaId":"GHSA-hmw2-7cc7-3qxx","cveId":null,"vulnerableRange":">=4.0.0 <4.0.6","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vitest","packageVersion":"<3.2.6","severity":"critical","title":"When Vitest UI server is listening, arbitrary file can be read and executed","advisoryUrl":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","ghsaId":"GHSA-5xrq-8626-4rwp","cveId":null,"vulnerableRange":"<3.2.6","fixAvailable":"4.1.10","source":"npm-audit","isDirect":true,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":9,"directDeps":0,"transitiveDeps":0}}]]}]

AI Tag Curator