e vault file","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/christianlempa/obsidian-pi/blob/refs/tags/0.0.13/main.js#L1331"},{"id":1158369,"pluginId":"pi-agent","version":"0.0.13","category":"vault_access","severity":"medium","filePath":"main.js","lineNumber":2576,"codeSnippet":" 2573 | this.getCurrentContextFile = getCurrentContextFile;\n 2574 | }\n 2575 | getMarkdownFiles() {\n> 2576 | return this.app.vault.getMarkdownFiles().filter((file) => this.isPathAllowed(file.path));\n 2577 | }\n 2578 | async searchNotes(query, options = {}) {\n 2579 | const terms = tokenizeQuery(query);","explanation":"Reads all markdown files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/christianlempa/obsidian-pi/blob/refs/tags/0.0.13/main.js#L2576"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.0.12","initialDiffTo":"0.0.13","summary":"The plugin reads one vault file and can read all markdown files in your vault to collect note text, links, backlinks, tags, and search results for use in chat context. Based on the provided metadata, it does not show any network activity, so there is no confirmed outbound data transfer. If you use the chat feature, it can send the selected note context to Pi to generate responses, but that network behavior is not explicitly documented here.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"fast-uri","packageVersion":">=3.0.0 <3.1.5","severity":"high","title":"fast-uri vulnerable to host confusion via backslash authority introducer","advisoryUrl":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","ghsaId":"GHSA-7p8r-x3mc-p8w7","cveId":nu

Pi Agent