}))\n 607 | \t\t\t];\n 608 | \n> 609 | \t\t\tconst response = await requestUrl({\n 610 | \t\t\t\turl: `https://generativelanguage.googleapis.com/v1beta/models/${this.settings.model\n 611 | \t\t\t\t\t}:generateContent?key=${this.getApiKey()}`,\n 612 | \t\t\t\tmethod: \"POST\",","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to generativelanguage.googleapis.com (https://generativelanguage.googleapis.com/v1beta/models/gemini-3-pro-preview:generateContent?key=)","endpointSource":"user-configured"},{"host":"localhost","url":null,"filePath":"main.ts","lineNumber":826,"codeSnippet":" 823 | \t\t\t\t}\n 824 | \t\t\t}\n 825 | \n> 826 | \t\t\tconst response = await requestUrl({\n 827 | \t\t\t\turl: url,\n 828 | \t\t\t\tmethod: \"POST\",\n 829 | \t\t\t\theaders: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to localhost (http://localhost:1234/v1) (allowlisted)","endpointSource":"user-configured"}],"initialDiff":{"pluginId":"vault-llm-assistant","fromVersion":"1.0.10","toVersion":"1.0.11","files":[{"path":"models.js","hunks":"$20","securityAnnotations":[]},{"path":"validate_models.js","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"1.0.10","initialDiffTo":"1.0.11","summary":"This plugin reads all markdown files from your vault and sends them to external AI services (OpenAI, Google Gemini, and Anthropic Claude) along with configured API keys to generate answers and create annotated notes. It stores hardcoded endpoints for multiple AI providers and makes HTTP POST requests to process your vault content through these services. API credentials are transmitted with each request to the external services. Base64 decoding is used for standard configuration handling.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":f

Vault LLM Assistant