this.app, this));\n \n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"0.0.7","initialDiffTo":"0.0.8","summary":"The plugin reads file contents from the vault and requests data from web services to embed Notion videos within notes. It makes inbound HTTP requests to fetch video metadata and embedding content, likely from Notion's CDN or API endpoints. No obfuscation is present, allowing direct inspection of network communication. The data flow is primarily one-directional—fetching remote video assets rather than exfiltrating vault contents.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"moment","packageVersion":">=2.18.0 <2.29.4","severity":"high","title":"Moment.js vulnerable to Inefficient Regular Expression Complexity","advisoryUrl":"https://github.com/advisories/GHSA-wc69-rhjr-hc9g","ghsaId":"GHSA-wc69-rhjr-hc9g","cveId":null,"vulnerableRange":">=2.18.0 <2.29.4","fixAvailable":"1.12.3","source":"npm-audit","isDirect":false,"path":"obsidian > moment"},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"semver","packageVersion":">=7.0.0 <7.5.2","severity":"high","title":"semver vulnerable to Regular Expression Denial of Service","advisoryUrl":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","ghsaId":"GHSA-c2qf-rxjj-qqgw","cveId":null,"vulnerableRange":">=7.0.0 <7.5.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":0,"transitiveDeps":0}}]]}]

Notion Video