,"disclosed":false,"sourceUrl":"https://github.com/leotomhal/sector-tasks-obsidian/blob/refs/tags/1.3.2/main.js#L535"},{"id":1171325,"pluginId":"sektor-tasks","version":"1.3.2","category":"permissions_scope","severity":"info","filePath":"main.js","lineNumber":1246,"codeSnippet":"this.app.vault.getAbstractFileByPath","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/leotomhal/sector-tasks-obsidian/blob/refs/tags/1.3.2/main.js#L1246"},{"id":1171326,"pluginId":"sektor-tasks","version":"1.3.2","category":"vault_access","severity":"info","filePath":"main.js","lineNumber":1246,"codeSnippet":" 1243 | }\n 1244 | validateTasksFilePath(value) {\n 1245 | const path = (0, import_obsidian2.normalizePath)((value || \"\").trim() || DEFAULT_SETTINGS.tasksFilePath);\n> 1246 | const existing = this.app.vault.getAbstractFileByPath(path);\n 1247 | if (existing && !(existing instanceof import_obsidian2.TFile)) {\n 1248 | return `\"${path}\" is a folder, not a file. Enter a path ending in a Markdown file, e.g. Tasks.md.`;\n 1249 | }","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/leotomhal/sector-tasks-obsidian/blob/refs/tags/1.3.2/main.js#L1246"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.3.1","initialDiffTo":"1.3.2","summary":"Confirmed: Sector Tasks reads a single file in your Obsidian vault by path and uses it to build a time-based task dashboard grouped by configurable tags. Confirmed: no network activity was observed, so it does not send data to any external service based on the available information. Capabilities: it can surface and organize tasks from that local file, but its access is limited to the one file it is configured to use.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl"