5.000Z","releaseDate":"2023-02-22T05:55:05.000Z","artifactStatus":"divergent"}],"findings":[{"id":731924,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":48,"codeSnippet":"this.app.vault.config.vimMode","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/main.ts#L48"},{"id":731925,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":66,"codeSnippet":"this.app.workspace.activeEditor.editor","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/main.ts#L66"},{"id":731926,"pluginId":"commando-command-repeater","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"vim-modal.ts","lineNumber":85,"codeSnippet":"this.app.commands.commands","explanation":"Accesses Obsidian API: app.commands","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qaptoR/Commando/blob/1.0.0/vim-modal.ts#L85"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.0","summary":"The plugin executes Obsidian commands repeatedly using either predefined or user-provided parameters without accessing vault data or making network requests. It does not interact with Obsidian's APIs for reading or modifying notes, and contains no obfuscated code. Its functionality is limited to local command repetition with no capability for external data collection or transmission.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"semver","packageVersion":">=7.0.0 <7.5.2","severity":"high","title":"semver vulnerable to Regular Expression Denial of Service","advisoryUrl":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","ghsaId":"GHSA-c2qf-rxjj-qqgw","cveId":null,"vulnerableRange":">=7.0.0 <7.5.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":0,"transitiveDeps":0}}]]}]