,"findings":[{"id":747088,"pluginId":"evernote-decryptor","version":"2.2.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":84,"codeSnippet":"this.app.workspace.off","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/rcmdnk/obsidian-evernote-decryptor/blob/2.2.0/src/main.ts#L84"},{"id":747089,"pluginId":"evernote-decryptor","version":"2.2.0","category":"obfuscation","severity":"info","filePath":"src/utils/cryptoUtils.ts","lineNumber":119,"codeSnippet":"atob(text)","explanation":"Decodes base64-encoded strings using atob()","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/rcmdnk/obsidian-evernote-decryptor/blob/2.2.0/src/utils/cryptoUtils.ts#L119"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"evernote-decryptor","fromVersion":"2.1.0","toVersion":"2.2.0","files":[{"path":"src/main.ts","hunks":"$20","securityAnnotations":[]},{"path":"src/settings/SettingsTab.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"2.1.0","initialDiffTo":"2.2.0","summary":"The plugin manages encrypted data that users import from Evernote, performing local decryption and base64 decoding operations within the vault. It does not access Obsidian's vault APIs and exhibits no network activity, indicating data processing occurs entirely client-side. The plugin handles sensitive Evernote data locally using basic decoding (atob) but does not transmit data externally.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisoryUrl":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","ghsaId":"GHSA-3ppc-4f35-3m26","cveId":null,"vulnerableRange":"<3.1.3","fixAvailable":null,"source":

Evernote Decryptor