:1136064,"pluginId":"mindcanvas","version":"0.2.7","category":"vault_access","severity":"medium","filePath":"src/ui/file-suggest-modal.ts","lineNumber":41,"codeSnippet":" 38 | }\n 39 | \n 40 | getItems(): TFile[] {\n> 41 | return this.app.vault.getFiles().filter((file) => {\n 42 | const targetKind = this.getTargetKindForFile(file);\n 43 | return targetKind !== null && this.filters[targetKind];\n 44 | });","explanation":"Accesses all files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/gengyabc/naotu/blob/refs/tags/0.2.7/src/ui/file-suggest-modal.ts#L41"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.2.6","initialDiffTo":"0.2.7","summary":"MindCanvas is confirmed to read one specific vault file and also has access to all files in your vault, so it can inspect or process vault content beyond a single note when its features are used. It does not make any network requests, so it does not send data to any external service. If the plugin is configured or triggered in a way that uses its full file access, it can work across the entire vault locally.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vitest","packageVersion":"<3.2.6","severity":"critical","title":"When Vitest UI server is listening, arbitrary file can be read and executed","advisoryUrl":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","ghsaId":"GHSA-5xrq-8626-4rwp","cveId":null,"vulnerableRange":"<3.2.6","fixAvailable":"4.1.10","source":"npm-audit","isDirect":true,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":9,"direc