ermissions_scope","severity":"info","filePath":"src/editor/embeddable-markdown-editor.ts","lineNumber":146,"codeSnippet":"app.scope","explanation":"Accesses Obsidian API: app.scope","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/kpaede/Excerpt-Outline-Mindmap-Editor/blob/refs/tags/0.1.0/src/editor/embeddable-markdown-editor.ts#L146"},{"id":1090086,"pluginId":"excerpt-outline-mindmap-editor","version":"0.1.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":269,"codeSnippet":"this.app.metadataCache.getFileCache","explanation":"Accesses Obsidian API: app.metadataCache","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/kpaede/Excerpt-Outline-Mindmap-Editor/blob/refs/tags/0.1.0/src/main.ts#L269"},{"id":1090087,"pluginId":"excerpt-outline-mindmap-editor","version":"0.1.0","category":"permissions_scope","severity":"info","filePath":"src/storage/frontmatter-storage.ts","lineNumber":99,"codeSnippet":"this.app.fileManager","explanation":"Accesses Obsidian API: app.fileManager","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/kpaede/Excerpt-Outline-Mindmap-Editor/blob/refs/tags/0.1.0/src/storage/frontmatter-storage.ts#L99"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/commands/export-vector.ts","lineNumber":769,"codeSnippet":" 766 | \n 767 | async function fetchAsDataUrl(url: string): Promise {\n 768 | try {\n> 769 | const response = await fetch(url);\n 770 | if (!response.ok) return null;\n 771 | \n 772 | const blob = await response.blob();","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"}],"initialDiff":null,"initialDiffFrom":"0.0.9","initialDiffTo":"0.1.0","summary":"The plugin reads a single file from your vault and uses it as the markdown outline behind the visual mindmap editor. Network-wise, it retrieves data from a configured endpoint, so it can fetch remote content if you set one up or trigger that feature. The available metadata does not indicate obfuscation, and it does not show the plugin sending vault data out.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <=4.1.1","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":">=4.0.0 <=4.1.1","f