yLevel":null,"analyzedAt":"2025-01-22T13:50:52.000Z","releaseDate":"2025-01-22T13:50:52.000Z","artifactStatus":"unavailable"},{"id":38929,"version":"1.0.2","score":88,"privacyLevel":null,"analyzedAt":"2025-01-22T13:50:52.000Z","releaseDate":"2025-01-22T13:50:52.000Z","artifactStatus":"unavailable"}],"findings":[{"id":906286,"pluginId":"runsh","version":"1.0.4","category":"network_calls","severity":"info","filePath":"main.ts","lineNumber":25,"codeSnippet":" 22 | const clickHandler = async (cmd: string) => {\n 23 | \tnew Notice(\"Running: \" + cmd);\n 24 | \n> 25 | \tspawn(cmd, {shell: true, detached: true, stdio: \"ignore\"})\n 26 | }\n 27 | ","explanation":"Runs commands in the background without showing results","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/Deedone/obsidian-runsh/blob/1.0.1/main.ts#L25"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"main.ts","lineNumber":25,"codeSnippet":" 22 | const clickHandler = async (cmd: string) => {\n 23 | \tnew Notice(\"Running: \" + cmd);\n 24 | \n> 25 | \tspawn(cmd, {shell: true, detached: true, stdio: \"ignore\"})\n 26 | }\n 27 | ","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.spawn() executes a shell command — review for network access","endpointSource":"unresolved"}],"initialDiff":{"pluginId":"runsh","fromVersion":"1.0.3","toVersion":"1.0.4","files":[],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.3","initialDiffTo":"1.0.4","summary":"The runsh plugin allows users to create buttons in notes that execute arbitrary shell commands when clicked, without displaying command output or results to the user. The plugin runs these commands in the background with active outbound network capability, meaning any shell command executed could potentially make network requests or access system resources. The plugin does not access Obsidian's vault APIs and includes no obfuscation. The primary security consideration is that users who create or import notes with runsh buttons could unknowingly execute potentially harmful commands if button definitions are malicious or compromised.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"pack

Runsh