aragi/obsidian-meeting-note-importer/blob/refs/tags/1.2.1/src/ts/noteCreator.ts#L133"},{"id":1133605,"pluginId":"meeting-note-importer","version":"1.2.1","category":"vault_access","severity":"info","filePath":"src/ts/noteCreator.ts","lineNumber":88,"codeSnippet":" 85 | \n 86 | async function ensureFolder(app: App, folderPath: string): Promise {\n 87 | if (!folderPath) return;\n> 88 | const existing = app.vault.getAbstractFileByPath(folderPath);\n 89 | if (existing instanceof TFolder) return;\n 90 | await app.vault.createFolder(folderPath);\n 91 | }","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/awaragi/obsidian-meeting-note-importer/blob/refs/tags/1.2.1/src/ts/noteCreator.ts#L88"},{"id":1133606,"pluginId":"meeting-note-importer","version":"1.2.1","category":"vault_access","severity":"medium","filePath":"src/ts/settingsTab.ts","lineNumber":62,"codeSnippet":" 59 | getSuggestions(query: string): TFolder[] {\n 60 | const lower = query.toLowerCase();\n 61 | const folders: TFolder[] = [];\n> 62 | this.app.vault.getAllLoadedFiles().forEach((f: TAbstractFile) => {\n 63 | if (f instanceof TFolder && f.path.toLowerCase().contains(lower)) {\n 64 | folders.push(f);\n 65 | }","explanation":"Accesses all files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/awaragi/obsidian-meeting-note-importer/blob/refs/tags/1.2.1/src/ts/settingsTab.ts#L62"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.2.0","initialDiffTo":"1.2.1","summary":"The plugin imports meeting notes from calendar invite data and reads a single vault file by path during that process. It also has access to all files in your vault, so it can inspect or use other notes if its logic triggers that capability. It does not send data over the network.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=3.0.0 <5.0.7","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=3.0.0 <5.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":12,"directD

Meeting Note Importer