0.1.3","score":100,"privacyLevel":0,"analyzedAt":"2026-08-19T16:41:56.000Z","releaseDate":"2026-07-09T14:51:42.000Z","artifactStatus":"verified"},{"id":118985,"version":"0.1.2","score":100,"privacyLevel":0,"analyzedAt":"2026-08-19T16:41:44.000Z","releaseDate":"2026-07-09T14:48:14.000Z","artifactStatus":null},{"id":118984,"version":"0.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-19T16:41:32.000Z","releaseDate":"2026-07-09T14:33:53.000Z","artifactStatus":null},{"id":118983,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-19T16:41:19.000Z","releaseDate":"2026-07-09T13:45:41.000Z","artifactStatus":null}],"findings":[{"id":1169818,"pluginId":"schematex","version":"0.1.3","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":29,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/maartenpeels/obsidian-schematex/blob/refs/tags/0.1.3/src/main.ts#L29"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.2","initialDiffTo":"0.1.3","summary":"The plugin demonstrably renders Schematex diagrams inside notes and provides pan, zoom, fullscreen, and image export controls. It does not use Obsidian vault APIs, and the provided metadata says it does not make network requests or send data off the device. If you trigger export, it can create an image from the rendered diagram locally.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite > esbuild"},{"packageName":"happy-dom","packageVersion":"<20.0.0","severity":"critical","title":"Happy DOM: VM Context Escape can lead to Remote Code Execution","advisoryUrl":"https://github.com/advisories/GHSA-37j7-fg3j-429f","ghsaId":"GHSA-37j7-fg3j-429f","cveId":null,"vulnerableRange":"<20.0.0","fixAvailable":"20.11.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"happy-dom","packageVersion":"<20.8.9","severity":"high","title":"Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies","advisoryUrl":"https://github.com/advisories/GHSA-w4gp-fjgq-3q4g","ghsaId":"GHSA-w4gp-fjgq-3q4g","cveId":null,"vulnerableRange":"<20.8.9","fixAvailable":"20.11.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"happy-dom","packageVersion":">=15.10.0 <=20.8.7","severity":"high","title":"Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code","advisoryUrl":"https://github.com/advisories/GHSA-6q6h-j7hj-3r64","ghsaId":"GHSA-6q6h-j7hj-3r64","cveId":null,"vulnerableRange":">=15.10.0 <=20.8.7","fixAvailable":"20.11.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl"