102 | return this.renderSql(await this.vault.read(file), file.name, bodyContainer);\n 103 | default:\n 104 | throw new Error(`Unsupported format: .${ext}`);\n 105 | }","explanation":"Reads a single vault file","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/zhouzeqiang/obsidian-vault-viewer/blob/refs/tags/1.1.0/src/services/OfficeRenderer.ts#L102"},{"id":1202195,"pluginId":"vault-viewer","version":"1.1.0","category":"permissions_scope","severity":"info","filePath":"src/views/VaultViewerView.ts","lineNumber":1504,"codeSnippet":"this.app.fileManager.trashFile","explanation":"Accesses Obsidian API: app.fileManager","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/zhouzeqiang/obsidian-vault-viewer/blob/refs/tags/1.1.0/src/views/VaultViewerView.ts#L1504"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.6","initialDiffTo":"1.1.0","summary":"This plugin demonstrably reads files in your vault, including access to all files and reading individual files, so it can list, filter, sort, and preview content from your local vault data. It does not show any network activity, so under observed behavior it does not send data to any external service. If future configuration or updates add remote features, it could send data to a network endpoint, but none were identified here.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":"<3.15.0","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":"<3.15.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=3.0.0 <3.15.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=3.0.0 <3.15.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"protobufjs","packageVersion":">=7.5.0 <=7.6.4","severity":"moderate","title":"protobufjs: Denial of Service via infinite loop in .proto option parsing","advisoryUrl":"https://github.com/advisories/GHSA-j3f2-48v5-ccww","ghsaId":"GHSA-j3f2-48v5-ccww","cveId":null,"vulnerableRange":">=7.5.0 <=7.6.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":18,"directDeps":9,"transitiveDeps":0}}]]}]

Vault Viewer