bsidian-things-link","version":"1.1.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":43,"codeSnippet":"this.app.workspace","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.2/main.ts#L43"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"obsidian-things-link","fromVersion":"1.1.1","toVersion":"1.1.2","files":[{"path":"main.ts","hunks":"$20","securityAnnotations":[{"lineNumber":118,"type":"resolved_finding","finding":{"category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":118,"codeSnippet":"this.app.vault","explanation":"Accesses Obsidian API: app.vault","sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.1/main.ts#L118"}}]}],"securityDelta":{"newFindings":[],"resolvedFindings":[{"category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":118,"codeSnippet":"this.app.vault","explanation":"Accesses Obsidian API: app.vault","sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.1/main.ts#L118"}],"scoreChange":-15}},"initialDiffFrom":"1.1.1","initialDiffTo":"1.1.2","summary":"This plugin facilitates local links between Obsidian notes and Things projects without accessing vault data or initiating network connections. It operates solely through local file system or inter-application communication mechanisms. With no network activity, vault API access, or obfuscation, the plugin presents minimal security risk and does not transmit user data beyond the local system.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"moment","packageVersion":"<2.29.2","severity":"high","title":"Path Traversal: 'dir/../../filename' in moment.locale","advisoryUrl":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","ghsaId":"GHSA-8hfj-j24r-96c4","cveId":null,"vulnerableRange":"<2.29.2","fixAvailable":"1.12.3","source":"npm-audit","isDirect":false,"path":"obsidian > moment"},{"packageName":"moment","packageVersion":">=2.18.0 <2.29.4","severity":"high","title":"Moment.js vulnerable to Inefficient Regular Expression Complexity","advisoryUrl":"https://github.com/advisories/GHSA-wc69-rhjr-hc9g","ghsaId":"GHSA-wc69-rhjr-hc9g","cveId":null,"vulnerableRange":">=2.18.0 <2.29.4","fixAvailable":"1.12.3","source":"npm-audit","isDirect":false,"path":"obsidian > moment"},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7

Things Link