Status":"verified"},{"id":117025,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-18T17:23:10.000Z","releaseDate":"2026-05-20T21:15:43.000Z","artifactStatus":null}],"findings":[{"id":1158305,"pluginId":"photo-album","version":"1.0.1","category":"permissions_scope","severity":"info","filePath":"src/Album.ts","lineNumber":74,"codeSnippet":"app.vault.adapter.list","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/solargate/obsidian-photo-album/blob/refs/tags/1.0.1/src/Album.ts#L74"},{"id":1158306,"pluginId":"photo-album","version":"1.0.1","category":"permissions_scope","severity":"info","filePath":"src/Album.ts","lineNumber":182,"codeSnippet":"app.workspace.getLeaf","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/solargate/obsidian-photo-album/blob/refs/tags/1.0.1/src/Album.ts#L182"},{"id":1158307,"pluginId":"photo-album","version":"1.0.1","category":"vault_access","severity":"info","filePath":"src/Album.ts","lineNumber":144,"codeSnippet":" 141 | \t\t\tif (cacheUrl) {\n 142 | \t\t\t\timg.src = cacheUrl;\n 143 | \t\t\t} else {\n> 144 | \t\t\t\tconst tfile = app.vault.getAbstractFileByPath(file.path) as TFile | null;\n 145 | \t\t\t\tif (tfile) {\n 146 | \t\t\t\t\timg.src = app.vault.adapter.getResourcePath(file.path);\n 147 | \t\t\t\t} else {","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/solargate/obsidian-photo-album/blob/refs/tags/1.0.1/src/Album.ts#L144"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"This plugin demonstrably reads a single file in your vault by its path, which it likely uses to build or update photo albums locally. No network activity was observed, so it does not appear to send data to any remote service. In terms of capability, it can access the contents of that one file and process them within Obsidian, but there is no evidence from the available data that it transmits vault data elsewhere.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <=4.1.1","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":">=4.0.0 <=4.1.1","fixAvailable":null,"so

Photo Album