026-05-14T10:40:04.000Z","artifactStatus":"verified"},{"id":102281,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T09:34:52.000Z","releaseDate":"2026-05-13T14:52:04.000Z","artifactStatus":null}],"findings":[{"id":1062694,"pluginId":"canvas-export","version":"1.0.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":22,"codeSnippet":"this.app.workspace.getActiveFile","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/rmoff/obsidian-canvas-export/blob/refs/tags/1.0.2/main.ts#L22"},{"id":1062695,"pluginId":"canvas-export","version":"1.0.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":109,"codeSnippet":"this.app.vault.read","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/rmoff/obsidian-canvas-export/blob/refs/tags/1.0.2/main.ts#L109"},{"id":1062696,"pluginId":"canvas-export","version":"1.0.2","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":109,"codeSnippet":" 106 | \n 107 | \tasync exportCanvas(file: TFile, formats: ExportFormat[], groupTitleSize: number, subfolder: string) {\n 108 | \t\ttry {\n> 109 | \t\t\tconst raw = await this.app.vault.read(file);\n 110 | \t\t\tconst canvas = JSON.parse(raw) as CanvasData;\n 111 | \t\t\tconst baseName = file.basename;\n 112 | \t\t\tconst opts = { baseName, groupTitleSize };","explanation":"Reads a single vault file","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/rmoff/obsidian-canvas-export/blob/refs/tags/1.0.2/main.ts#L109"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.1","initialDiffTo":"1.0.2","summary":"This plugin reads one vault file: the canvas file you export, and uses that content to generate output in HTML, Excalidraw, Mermaid, D2, or PDF when you trigger an export. It does not make network requests and does not send data to any external endpoints based on the available review.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=3.0.0 <5.0.7","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=3.0.0 <5.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":fals

Canvas Export