factStatus":"verified"},{"id":103016,"version":"0.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T16:17:09.000Z","releaseDate":"2026-07-27T16:45:27.000Z","artifactStatus":null},{"id":103015,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T16:16:59.000Z","releaseDate":"2026-07-21T15:10:57.000Z","artifactStatus":null}],"findings":[{"id":1067216,"pluginId":"cite","version":"0.1.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":26,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/pmgwork/obsidian-cite/blob/refs/tags/0.1.2/main.ts#L26"},{"id":1067217,"pluginId":"cite","version":"0.1.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":62,"codeSnippet":"this.app.workspace.layoutReady","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/pmgwork/obsidian-cite/blob/refs/tags/0.1.2/main.ts#L62"},{"id":1067218,"pluginId":"cite","version":"0.1.2","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":97,"codeSnippet":" 94 | }\n 95 | \n 96 | private async getSourceText(sourcePath: string): Promise {\n> 97 | const file = this.app.vault.getAbstractFileByPath(sourcePath);\n 98 | if (!(file instanceof TFile)) return \"\";\n 99 | const cached = this.sourceCache.get(sourcePath);\n 100 | if (cached?.mtime === file.stat.mtime) return cached.text;","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/pmgwork/obsidian-cite/blob/refs/tags/0.1.2/main.ts#L97"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.1","initialDiffTo":"0.1.2","summary":"The plugin reads a single note file by path in your vault so it can render and link LaTeX or Pandoc citations from BibTeX blocks. It has no recorded network activity, so it does not send data to any endpoints.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"so

Cite