ence":null,"disclosed":false,"sourceUrl":"https://github.com/bueckerlars/obsidian-note-mover-shortcut/blob/0.7.2/src/core/MetadataExtractor.ts#L32"},{"id":806806,"pluginId":"note-mover-shortcut","version":"0.7.2","category":"vault_access","severity":"medium","filePath":"src/core/MetadataExtractor.ts","lineNumber":124,"codeSnippet":" 121 | */\n 122 | public extractAllTags(): Set {\n 123 | const tags = new Set();\n> 124 | const files = this.app.vault.getMarkdownFiles();\n 125 | \n 126 | files.forEach(file => {\n 127 | try {","explanation":"Reads all markdown files from the vault to extract tags","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/bueckerlars/obsidian-note-mover-shortcut/blob/0.7.2/src/core/MetadataExtractor.ts#L124"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"note-mover-shortcut","fromVersion":"0.7.1","toVersion":"0.7.2","files":[{"path":"src/utils/OperatorMapping.ts","hunks":"@@ -138,9 +138,9 @@ export function getOperatorsForCriteriaType(\n return DATE_OPERATORS;\n \n case 'properties':\n- // For properties, we need to know the property type to determine operators\n- // Return base property operators as default\n- return BASE_PROPERTY_OPERATORS;\n+ // When the property type is still unknown, fall back to text-style\n+ // property operators so users can still select value-based comparisons.\n+ return [...BASE_PROPERTY_OPERATORS, ...TEXT_OPERATORS];\n \n default:\n return [];\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":1}},"initialDiffFrom":"0.7.1","initialDiffTo":"0.7.2","summary":"This plugin reads your vault to check for file existence by path and scans all markdown files to extract tags, enabling intelligent note organization and movement to predefined folders. It operates entirely locally with no network communication, obfuscation, or external data transmission. The data access is limited to file system checks and local markdown content scanning within your vault.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":">=4.0.0 <4.0.4","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":">=4.0.0 <4.0.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":">=4.0.0 <4.0.4","severity":"high","title":"Picomatch has a ReD

NoteMover shortcut