his.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L9"},{"id":900681,"pluginId":"reader-mode","version":"1.0.4","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":28,"codeSnippet":"this.app.vault.cachedRead","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L28"},{"id":900682,"pluginId":"reader-mode","version":"1.0.4","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":28,"codeSnippet":" 25 | \t\t\t\t\tconst state = leaf.getViewState();\n 26 | \t\t\t\t\tif (!state.state) return;\n 27 | \n> 28 | const content = await this.app.vault.cachedRead(file);\n 29 | const strippedContent = content.replace(/^---\\\\s*\\\\n[\\\\s\\\\S]*?\\\\n---\\\\s*\\\\n*/, '''').trim();\n 30 | if (strippedContent) {\n 31 | state.state.mode = ''preview'';","explanation":"Reads file contents from the vault and removes metadata headers","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L28"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"reader-mode","fromVersion":"1.0.3","toVersion":"1.0.4","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.3","initialDiffTo":"1.0.4","summary":"Reader-mode operates entirely locally, reading note file contents from your vault and stripping YAML frontmatter headers before displaying notes in reader view. It makes no network requests and contains no obfuscation. The plugin's data access is limited to vault files you explicitly open, with no exfiltration or external communication.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/

Reader Mode