:05.000Z","releaseDate":"2023-02-22T05:55:05.000Z","artifactStatus":"divergent"}],"findings":[{"id":731924,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":48,"codeSnippet":"this.app.vault.config.vimMode","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/main.ts#L48"},{"id":731925,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":66,"codeSnippet":"this.app.workspace.activeEditor.editor","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/main.ts#L66"},{"id":731926,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"vim-modal.ts","lineNumber":85,"codeSnippet":"this.app.commands.commands","explanation":"Accesses Obsidian API: app.commands","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/vim-modal.ts#L85"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.0","summary":"The commando-command-repeater plugin enables users to repeatedly execute Obsidian commands using predefined or user-specified parameters for each invocation. It does not access vault data through Obsidian APIs and performs no network communication. The plugin's functionality is limited to local command execution within the Obsidian application context, with no external data transmission or vault file access.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"semver","packageVersion":">=7.0.0 <7.5.2","severity":"high","title":"semver vulnerable to Regular Expression Denial of Service","advisoryUrl":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","ghsaId":"GHSA-c2qf-rxjj-qqgw","cveId":null,"vulnerableRange":">=7.0.0 <7.5.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":0,"transitiveDeps":0}}]]}]