permissions_scope","severity":"info","filePath":"src/utils.ts","lineNumber":36,"codeSnippet":"app.metadataCache.getFileCache","explanation":"Accesses Obsidian API: app.metadataCache","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/christianwannerstedt/obsidian-tags-overview/blob/refs/tags/1.0.8/src/utils.ts#L36"},{"id":1185568,"pluginId":"tags-overview","version":"1.0.8","category":"permissions_scope","severity":"info","filePath":"src/utils.ts","lineNumber":126,"codeSnippet":"app.vault.getMarkdownFiles","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/christianwannerstedt/obsidian-tags-overview/blob/refs/tags/1.0.8/src/utils.ts#L126"},{"id":1185569,"pluginId":"tags-overview","version":"1.0.8","category":"vault_access","severity":"medium","filePath":"src/utils.ts","lineNumber":126,"codeSnippet":" 123 | export const getAllTagsAndFiles = (app: App, excludePaths: string[] = []) => {\n 124 | const taggedFilesMap = new Map();\n 125 | let allTags: string[] = [];\n> 126 | app.vault.getMarkdownFiles().forEach((markdownFile: TFile) => {\n 127 | const taggedFile: TaggedFile = getTaggedFileFromFile(app, markdownFile);\n 128 | if (shouldIncludeTaggedFile(taggedFile, excludePaths)) {\n 129 | allTags = [...allTags, ...getNestedTags(taggedFile), ...taggedFile.tags];","explanation":"Reads all markdown files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/christianwannerstedt/obsidian-tags-overview/blob/refs/tags/1.0.8/src/utils.ts#L126"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.7","initialDiffTo":"1.0.8","summary":"The plugin reads all markdown files in your vault to build an extended tags panel, so it can inspect file contents and tag data to show, filter, and open tagged notes. It does not have any confirmed network behavior and does not send data to any endpoints. In normal use, its functionality is limited to local vault access, though it can surface any tagged file it can read in the vault.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":nul

Tags Overview