,{"id":1205790,"pluginId":"virtual-footer","version":"1.0.38","category":"vault_access","severity":"medium","filePath":"main.ts","lineNumber":964,"codeSnippet":" 961 | \t\t\tif (resolved) {\n 962 | \t\t\t\treturn resolved.path;\n 963 | \t\t\t}\n> 964 | \t\t\tconst abstractFile = this.app.vault.getAbstractFileByPath(cleaned);\n 965 | \t\t\tif (abstractFile instanceof TFile) {\n 966 | \t\t\t\treturn abstractFile.path;\n 967 | \t\t\t}","explanation":"Reads a single vault file by path in a loop over all files","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/signynt/virtual-content/blob/refs/tags/1.0.38/main.ts#L964"},{"id":1205791,"pluginId":"virtual-footer","version":"1.0.38","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":2763,"codeSnippet":" 2760 | \t\t\tconst file = this.app.vault.getAbstractFileByPath(rule.footerFilePath);\n 2761 | \t\t\tif (file instanceof TFile) {\n 2762 | \t\t\t\ttry {\n> 2763 | \t\t\t\t\treturn await this.app.vault.cachedRead(file);\n 2764 | \t\t\t\t} catch (error) {\n 2765 | \t\t\t\t\tconsole.error(`VirtualFooter: Error reading content file ${rule.footerFilePath}`, error);\n 2766 | \t\t\t\t\treturn ``; // Return error message in content","explanation":"Reads a single vault file (cached)","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/signynt/virtual-content/blob/refs/tags/1.0.38/main.ts#L2763"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.37","initialDiffTo":"1.0.38","summary":"Confirmed behavior: the plugin scans through vault files by path, reading note contents in a loop and using cached single-file reads to decide which notes match its rule. It then displays the specified markdown, including Dataview queries or Bases, in the top, bottom, or sidebar for those matching notes without modifying the files. It does not make any network requests, so it does not send data to any external endpoint.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <=4.1.1","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":">=4.0.0 <=4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":7,"directDeps":0,"transitiveDeps":0}}]]}]

Virtual Content