lse,"sourceUrl":"https://github.com/TGRRRR/Canvas-link-to-group/blob/0.0.6/main.ts#L27"},{"id":727052,"pluginId":"canvas-link-to-group","version":"0.0.6","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":259,"codeSnippet":"this.app.vault.cachedRead","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/TGRRRR/Canvas-link-to-group/blob/0.0.6/main.ts#L259"},{"id":727053,"pluginId":"canvas-link-to-group","version":"0.0.6","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":259,"codeSnippet":" 256 | \t\tif (!canvasFile) return [];\n 257 | \n 258 | \t\ttry {\n> 259 | \t\t\tconst fileContent = await this.app.vault.cachedRead(canvasFile);\n 260 | \t\t\tconst canvasData = JSON.parse(fileContent);\n 261 | \n 262 | \t\t\tif (!canvasData.nodes || !Array.isArray(canvasData.nodes)) return [];","explanation":"Reads canvas files from the vault and parses their contents","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/TGRRRR/Canvas-link-to-group/blob/0.0.6/main.ts#L259"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"canvas-link-to-group","fromVersion":"0.0.5","toVersion":"0.0.6","files":[{"path":"main.ts","hunks":"$20","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"0.0.5","initialDiffTo":"0.0.6","summary":"The plugin reads canvas files stored in your Obsidian vault and parses their contents to identify groups and generate links to them. It performs no network requests and does not send any data outside your local vault. The plugin contains no obfuscation, making its file-reading and parsing operations transparent.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non

Canvas Link to Group