\t\t\texecFile(\n 167 | \t\t\t\tcommand,\n 168 | \t\t\t\targs,\n 169 | \t\t\t\t(","explanation":"child_process.execFile() executes a shell command — review for network access","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/awaken233/open-in-cursor/blob/1.0.11/main.ts#L166"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"main.ts","lineNumber":166,"codeSnippet":" 163 | \t\t\t}\n 164 | \n 165 | \t\t\t// Execute command using execFile for better performance and security\n> 166 | \t\t\texecFile(\n 167 | \t\t\t\tcommand,\n 168 | \t\t\t\targs,\n 169 | \t\t\t\t(","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.execFile() executes a shell command — review for network access","endpointSource":"unresolved"}],"initialDiff":{"pluginId":"open-in-cursor","fromVersion":"1.0.10","toVersion":"1.0.11","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"1.0.10","initialDiffTo":"1.0.11","summary":"This plugin executes shell commands via child_process.execFile() to launch the Cursor IDE application with the current file path and cursor position as arguments. It does not access Obsidian vault data or use Obsidian APIs, and no network endpoints are evident. The only data passed is the file path and cursor position to a local application executable, with no confirmed outbound network activity—the shell execution is local process invocation.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisoryUrl":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","ghsaId":"GHSA-3ppc-4f35-3m26","cveId":null,"vulnerableRange":"<3.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"

Open in Cursor