luginId":"obsidian-things-link","version":"1.1.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":43,"codeSnippet":"this.app.workspace","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.2/main.ts#L43"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"obsidian-things-link","fromVersion":"1.1.1","toVersion":"1.1.2","files":[{"path":"main.ts","hunks":"$20","securityAnnotations":[{"lineNumber":118,"type":"resolved_finding","finding":{"category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":118,"codeSnippet":"this.app.vault","explanation":"Accesses Obsidian API: app.vault","sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.1/main.ts#L118"}}]}],"securityDelta":{"newFindings":[],"resolvedFindings":[{"category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":118,"codeSnippet":"this.app.vault","explanation":"Accesses Obsidian API: app.vault","sourceUrl":"https://github.com/gavinmn/obsidian-things-link/blob/1.1.1/main.ts#L118"}],"scoreChange":-15}},"initialDiffFrom":"1.1.1","initialDiffTo":"1.1.2","summary":"The obsidian-things-link plugin creates local links between Obsidian notes and Things Project entries without accessing Obsidian's vault APIs or making network requests. No data exfiltration vectors are present in the confirmed behavior. The plugin's privacy level is undefined in its metadata, though the technical analysis shows no active data collection or transmission mechanisms.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"moment","packageVersion":"<2.29.2","severity":"high","title":"Path Traversal: 'dir/../../filename' in moment.locale","advisoryUrl":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","ghsaId":"GHSA-8hfj-j24r-96c4","cveId":null,"vulnerableRange":"<2.29.2","fixAvailable":"1.12.3","source":"npm-audit","isDirect":false,"path":"obsidian > moment"},{"packageName":"moment","packageVersion":">=2.18.0 <2.29.4","severity":"high","title":"Moment.js vulnerable to Inefficient Regular Expression Complexity","advisoryUrl":"https://github.com/advisories/GHSA-wc69-rhjr-hc9g","ghsaId":"GHSA-wc69-rhjr-hc9g","cveId":null,"vulnerableRange":">=2.18.0 <2.29.4","fixAvailable":"1.12.3","source":"npm-audit","isDirect":false,"path":"obsidian > moment"},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2

Things Link