ings":[{"id":772786,"pluginId":"horizontal-blocks","version":"1.1.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":1211,"codeSnippet":"this.app.workspace.onLayoutReady","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/iCodeAlchemy/horizontal-blocks/blob/1.1.2/main.ts#L1211"},{"id":772787,"pluginId":"horizontal-blocks","version":"1.1.2","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":190,"codeSnippet":" 187 | \n 188 | const loadSection = async () => {\n 189 | this.isProgrammaticUpdate = true;\n> 190 | const fileContent = await this.plugin.app.vault.read(file);\n 191 | const sectionContent = this.extractSection(fileContent, section);\n 192 | this.updateHeaderState(sectionContent);\n 193 | const cursor = editor.getCursor();","explanation":"Reads text from a file in the vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/iCodeAlchemy/horizontal-blocks/blob/1.1.2/main.ts#L190"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"horizontal-blocks","fromVersion":"1.1.1","toVersion":"1.1.2","files":[{"path":"main.ts","hunks":"@@ -1213,7 +1213,8 @@ export default class HorizontalBlocksPlugin extends Plugin {\n new ReleaseNotes(\n this.app,\n this,\n- isFirstInstall ? null : currentVersion,\n+ currentVersion,\n+ isFirstInstall,\n ).open();\n } catch (e) {\n new Notice(\"Error opening release notes\", 6000);\n","securityAnnotations":[]},{"path":"src/dialogs/ReleaseNotes.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.1.1","initialDiffTo":"1.1.2","summary":"The plugin reads text content from vault files to support its block layout functionality, including rendering of Markdown text, images, embeds, and internal links. No network activity is detected, and the code contains no obfuscation. The plugin's privacy level is undefined, though data remains locally stored based on its reliance on vault file APIs.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.

Horizontal Blocks