"version":"1.0.0","score":100,"privacyLevel":null,"analyzedAt":"2024-12-26T12:56:57.000Z","releaseDate":"2024-12-26T12:56:57.000Z","artifactStatus":"verified"}],"findings":[{"id":917662,"pluginId":"smart-link-alias","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"src/link-decorations.field.ts","lineNumber":162,"codeSnippet":"this.app.workspace.openLinkText","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/vpcano/obsidian-smart-link-alias/blob/1.0.0/src/link-decorations.field.ts#L162"},{"id":917663,"pluginId":"smart-link-alias","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"src/smart-link-alias.functions.ts","lineNumber":5,"codeSnippet":"app.metadataCache.getFirstLinkpathDest","explanation":"Accesses Obsidian API: app.metadataCache","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/vpcano/obsidian-smart-link-alias/blob/1.0.0/src/smart-link-alias.functions.ts#L5"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.0","summary":"```json\n{\n \"id\": \"security-analysis-1\",\n \"object\": \"security_summary\",\n \"summary\": \"Smart-link-alias is a display-only plugin that modifies how internal note links appear in Obsidian without accessing the Vault API or establishing network connections. It locally processes link rendering to show shortened, full, or combined note titles based on user preferences. No data leaves the vault, and the plugin requires no external communication or elevated permissions to function.\"\n}\n```","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv

Smart Link Alias