ory":"code_execution","severity":"info","filePath":"src/main.ts","lineNumber":27,"codeSnippet":"import('./codeblock/DrawioCodeBlock')","explanation":"Dynamic import() loads a module — bundler chunk-splitting pattern","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/doge-liang/obsidian-drawio/blob/refs/tags/0.5.3/src/main.ts#L27"},{"id":1082138,"pluginId":"drawio-editor","version":"0.5.3","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":53,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/doge-liang/obsidian-drawio/blob/refs/tags/0.5.3/src/main.ts#L53"},{"id":1082139,"pluginId":"drawio-editor","version":"0.5.3","category":"obfuscation","severity":"info","filePath":"src/model/dualFormat.ts","lineNumber":125,"codeSnippet":"atob(b64)","explanation":"Decodes base64-encoded strings using atob()","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/doge-liang/obsidian-drawio/blob/refs/tags/0.5.3/src/model/dualFormat.ts#L125"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.5.2","initialDiffTo":"0.5.3","summary":"This plugin is confirmed to read a single file from your vault by path, which it uses to embed, preview, and edit Draw.io diagrams in Obsidian. It does not show any network activity, so there is no confirmed behavior of sending data to external services. It also decodes some base64-encoded strings locally with `atob()`, which is an internal data transformation rather than a network function.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite > esbuild"},{"packageName":"form-data","packageVersion":">=4.0.0 <4.0.6","severity":"high","title":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","advisoryUrl":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","ghsaId":"GHSA-hmw2-7cc7-3qxx","cveId":null,"vulnerableRange":">=4.0.0 <4.0.6","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vite