QmdProcess.ts","lineNumber":58,"codeSnippet":" 55 | return new Promise((resolve, reject) => {\n 56 | // qmd CLI는 stdout이 직접 파이프일 때 8KB 부근에서 출력이 절단되는 동작을 보인다.\n 57 | // 셸 + cat 을 중간에 두어 우회. \"$0\" \"$@\" 패턴으로 인자 escape를 셸에 위임 (injection-safe).\n> 58 | const proc = execFile(\n 59 | '/bin/sh',\n 60 | ['-c', '\"$0\" \"$@\" | cat', this.binaryPath, ...args],\n 61 | {","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.execFile() executes a shell command — review for network access","endpointSource":"unresolved"},{"host":"","url":null,"filePath":"src/core/QmdProcess.ts","lineNumber":108,"codeSnippet":" 105 | ): Promise {\n 106 | const timeout = options.timeout ?? 600_000;\n 107 | return new Promise((resolve, reject) => {\n> 108 | const proc = spawn(this.binaryPath, args, { env: buildEnv() });\n 109 | let stdoutBuf = '';\n 110 | let stderrBuf = '';\n 111 | let stdoutTail = '';","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.spawn() executes a shell command — review for network access","endpointSource":"unresolved"}],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"0.1.1","summary":"The plugin uses the external `qmd` CLI to search your vault with BM25, vector, and hybrid semantic retrieval. Confirmed data access includes reading all Markdown files in the vault and reading a single file by path. It also launches a shell command with `child_process.execFile()`, so the plugin can invoke the external CLI, which could send data to whatever network service that CLI is configured to use.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=8.0.0 <=8.0.15","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=8.0.0 <=8.0.15","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=8.0.0 <=8.0.15","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":">=8.0.0 <=8.0.15","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":5,"directDeps":0,"transitiveDeps":0}}]]}]

Star QMD