odeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L9"},{"id":900681,"pluginId":"reader-mode","version":"1.0.4","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":28,"codeSnippet":"this.app.vault.cachedRead","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L28"},{"id":900682,"pluginId":"reader-mode","version":"1.0.4","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":28,"codeSnippet":" 25 | \t\t\t\t\tconst state = leaf.getViewState();\n 26 | \t\t\t\t\tif (!state.state) return;\n 27 | \n> 28 | const content = await this.app.vault.cachedRead(file);\n 29 | const strippedContent = content.replace(/^---\\\\s*\\\\n[\\\\s\\\\S]*?\\\\n---\\\\s*\\\\n*/, '''').trim();\n 30 | if (strippedContent) {\n 31 | state.state.mode = ''preview'';","explanation":"Reads file contents from the vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/dominikmayer/obsidian-reader-mode/blob/1.0.4/main.ts#L28"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"reader-mode","fromVersion":"1.0.3","toVersion":"1.0.4","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.3","initialDiffTo":"1.0.4","summary":"The plugin modifies how notes open by automatically switching them to reader mode. It reads note contents from your vault to render the appropriate display state. The plugin performs no network activity and operates entirely locally without external data transmission.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<

Reader Mode