og","artifactDivergenceSummary":null,"activityTier":"stale"},"versions":[{"id":5290,"version":"0.1.0","score":100,"privacyLevel":null,"analyzedAt":"2024-10-06T20:17:53.000Z","releaseDate":"2024-10-06T20:17:53.000Z","artifactStatus":"unavailable"}],"findings":[],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"0.1.0","summary":"This plugin provides a runtime environment for executing Clojure code directly within Obsidian, acting as a host for user-defined Clojure-based plugins. The analysis shows no direct vault data access, no network communication, and no code obfuscation. The primary security surface is the execution of arbitrary Clojure code within the editor process—any security risks depend entirely on what Clojure plugins a user chooses to load and execute.","dependencyVulnerabilities":[{"packageName":"bn.js","packageVersion":">=5.0.0 <5.2.3","severity":"moderate","title":"bn.js affected by an infinite loop","advisoryUrl":"https://github.com/advisories/GHSA-378v-28hj-76wf","ghsaId":"GHSA-378v-28hj-76wf","cveId":null,"vulnerableRange":">=5.0.0 <5.2.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"bn.js","packageVersion":"<4.12.3","severity":"moderate","title":"bn.js affected by an infinite loop","advisoryUrl":"https://github.com/advisories/GHSA-378v-28hj-76wf","ghsaId":"GHSA-378v-28hj-76wf","cveId":null,"vulnerableRange":"<4.12.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"cipher-base","packageVersion":"<=1.0.4","severity":"critical","title":"cipher-base is missing type checks, leading to hash rewind and passing on crafted data","advisoryUrl":"https://github.com/advisories/GHSA-cpq7-6gpm-g9rc","ghsaId":"GHSA-cpq7-6gpm-g9rc","cveId":null,"vulnerableRange":"<=1.0.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"elliptic","packageVersion":"<=6.6.0","severity":"critical","title":"Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)","advisoryUrl":"https://github.com/advisories/GHSA-vjh7-7g9h-fjfh","ghsaId":"GHSA-vjh7-7g9h-fjfh","cveId":null,"vulnerableRange":"<=6.6.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"elliptic","packageVersion":"<6.6.0","severity":"low","title":"Valid ECDSA signatures erroneously rejected in Elliptic","advisoryUrl":"https://github.com/advisories/GHSA-fc9h-whq2-v747","ghsaId":"GHSA-fc9h-whq2-v747","cveId":null,"vulnerableRange":"<6.6.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"elliptic","packageVersion":"<=6.6.1","severity":"low","title":"Elliptic Uses a Cryptographic Primitive with a Risky Implementation","advisoryUrl":"https://github.com/advisories/GHSA-848j-6mx2-7j84","ghsaId":"GHSA-848j-6mx2-7j84","cveId":null,"vulnerableRange":"<=6.6.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"markdown-it","packageVersion":">=13.0.0 <14.1.1","severity":"moderate","title":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","advisoryUrl":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","ghsaId":"GHSA-38c4-r59v-3vqw","cveId":null,"vulnerableRange":">=13.0.0 <14.1.1","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null},{"packageName":"pbkdf2","packageVersion":">=3.0.10 <=3.1.2","severity":"critical","title":"pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos","advisoryUrl":"https://github.com/advisories/GHSA-h7cp-r72f-jxh6","ghsaId":"GHSA-h7cp-r72f-jxh6","cveId":null,"vulnerableRange":">=3.0.10 <=3.

Clojure Plugin Host