What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-4x5r-pxfx-6jf8 applies
Minor caution · medium confidence
A dependency used by this SillyTavern extension has a known low-severity issue. Because the extension ships only a bundled file to end users and many advisories affect build-time or test-time tools that never reach the user, the practical risk is limited.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.
Contextual assessment: The advisory is matched against a dependency declared in package-lock.json. The project ships a webpack bundle (dist/index.js) as a SillyTavern extension; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the extension's limited attack surface (processing LLM-generated tracking data in the browser), concrete user harm is unlikely. The low scanner severity further supports a limited practical impact.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version if one is available; for dev-only dependencies, updating during the next maintenance cycle is sufficient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4x5r-pxfx-6jf8
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fv7c-fp4j-7gwp applies
Minor caution · medium confidence
A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp to a dependency declared by this repository.
Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) and numerous devDependencies (babel, jest, webpack, sass, etc.). The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.
Impact: low · Exploitability: unlikely
Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fv7c-fp4j-7gwp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh29-5h37-fv8m applies
Minor caution · medium confidence
A dependency has a known medium-severity issue. Since the extension ships only a bundled file and many advisories affect build-time tools that never reach the user, the practical risk is limited.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh29-5h37-fv8m to a dependency declared by this repository.
Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle to end users; devDependencies are not included. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the extension's limited browser-context attack surface, concrete user harm is unlikely.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh29-5h37-fv8m
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-jp2q-39xq-3w4g applies
Minor caution · medium confidence
A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-jp2q-39xq-3w4g to a dependency declared by this repository.
Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-jp2q-39xq-3w4g
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7rx3-28cr-v5wh applies
Minor caution · medium confidence
A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7rx3-28cr-v5wh to a dependency declared by this repository.
Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7rx3-28cr-v5wh
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-qj8w-gfj5-8c6v applies
Minor caution · medium confidence
A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-qj8w-gfj5-8c6v to a dependency declared by this repository.
Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-qj8w-gfj5-8c6v
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-jmr7-xgp7-cmfj applies
Minor caution · medium confidence
A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-jmr7-xgp7-cmfj to a dependency declared by this repository.
Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies and numerous devDependencies. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.
Impact: low · Exploitability: unlikely
Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-jmr7-xgp7-cmfj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-8gc5-j5rx-235r applies
Minor caution · medium confidence
A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8gc5-j5rx-235r to a dependency declared by this repository.
Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies and numerous devDependencies. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.
Impact: low · Exploitability: unlikely
Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8gc5-j5rx-235r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-5c6j-r48x-rmvq applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-5c6j-r48x-rmvq to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-5c6j-r48x-rmvq
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-9cx6-37pm-9jff applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-9cx6-37pm-9jff to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-9cx6-37pm-9jff
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-37qj-frw5-hhjh applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-37qj-frw5-hhjh to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-37qj-frw5-hhjh
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v2hh-gcrm-f6hx applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v2hh-gcrm-f6hx
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-m7jm-9gc2-mpf2 applies
Minor caution · medium confidence
A serious known security issue was found in one of the tools used to build this extension. Even though the issue is rated critical, the extension only ships the finished build output and not the building tools, so this most likely does not affect people who install and use the extension. The developer should still update the affected tool to be safe.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-m7jm-9gc2-mpf2 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a critical-severity advisory in the lockfile. Despite the critical scanner rating, the lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users. The critical rating reflects the advisory's worst-case severity, not the actual exposure in this project's deployment model.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory. Even though it likely does not affect the shipped extension, resolving a critical advisory in the development environment is good practice.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-m7jm-9gc2-mpf2
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2g4f-4pwh-qvx6 applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2g4f-4pwh-qvx6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v39h-62p7-jpjc applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v39h-62p7-jpjc
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-h67p-54hq-rp68 applies
Minor caution · medium confidence
A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-h67p-54hq-rp68
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-q3j6-qgpj-74h6 applies
Minor caution · low confidence
A security scanner flagged an outdated package in the project's dependency list. However, the extension ships a pre-built file and the flagged package is most likely a development tool that never runs on users' machines.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lockfile. The project has only three production dependencies (fast-xml-parser 5.2.5+, handlebars 4.7.8, sillytavern-utils-lib 1.0.64+), all at recent patched versions. The extensive devDependencies (babel, jest, webpack, sass, prettier, typescript, loaders) are build-time only and do not ship to end users. The extension loads pre-built dist/index.js per the manifest. Without the specific lockfile entry showing which package is affected, the advisory most likely targets a build-toolchain transitive dependency that never executes in the production extension runtime.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-q3j6-qgpj-74h6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-wf6x-7x77-mvgw applies
Minor caution · low confidence
A security scanner found a vulnerable package version in the project's dependencies. Since the extension is pre-built and the flagged dependency is likely a development-only tool, it probably does not affect users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-wf6x-7x77-mvgw to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lockfile. The project's production dependencies are minimal and at current versions. The large devDependency tree (webpack, babel, jest, sass, typescript ecosystem) is used only for building dist/index.js. The extension manifest references pre-built artifacts, so build-toolchain dependencies and their transitive advisories do not reach end-user runtime.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-wf6x-7x77-mvgw
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-gh4j-gqv2-49f6 applies
Minor caution · low confidence
A scanner flagged a moderately vulnerable package. It is most likely a development tool that does not run when the extension is used.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-gh4j-gqv2-49f6 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a dependency in the lockfile. Given the project's architecture—three recent production dependencies bundled via webpack into dist/index.js, with all build tooling as devDependencies—the affected package is most likely in the development toolchain and not shipped to end users. The scanner's medium severity reflects the advisory's theoretical impact, not runtime reachability in this extension.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-gh4j-gqv2-49f6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-23c5-xmqv-rm74 applies
Minor caution · low confidence
A scanner found a vulnerable package version. The flagged package is probably a development tool that never runs for end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.
Contextual assessment: This advisory matches a lockfile dependency. The project ships pre-built dist/index.js; the development dependencies used to build it (babel, webpack, jest, sass, etc.) are not loaded at runtime by SillyTavern. Production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) are at recent patched versions, making it likely this advisory targets a build-tool transitive dependency.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-23c5-xmqv-rm74
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · low confidence
A scanner flagged a vulnerable package. Since the extension uses pre-built files, this dependency likely only runs during development and does not affect users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: This advisory matches a lockfile dependency. The extension manifest loads dist/index.js and dist/style.css, which are pre-built artifacts. The substantial devDependency tree is only used during the build process and does not execute on end-user machines. The three production dependencies are at current versions. Without the specific lockfile entry, the advisory most likely targets a build-time transitive dependency with no production runtime reach.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2w6w-674q-4c4q applies
Minor caution · low confidence
A scanner found a critically-rated vulnerable package. However, the extension ships pre-built files, and this package is most likely a development tool that never runs for users. The critical rating reflects the package's theoretical risk, not actual exposure in this extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2w6w-674q-4c4q to a dependency declared by this repository.
Contextual assessment: This critical-severity advisory matches a lockfile dependency. Despite the critical advisory rating, the specific affected package and its locked version are not shown. The project's production dependencies are minimal and recent. The extension ships pre-built dist/index.js, meaning the extensive build toolchain (babel, jest, webpack, sass, typescript ecosystem) does not execute on end-user machines. Critical advisories in npm ecosystems frequently target build-time or dev-time packages (e.g., arbitrary file operations during install or ReDoS in development servers) that are not reachable in a bundled browser extension. Without the specific package identity and its production reachability, the advisory's theoretical severity does not translate to demonstrated user harm in this extension context.
Impact: low · Exploitability: unlikely
Developer action: Identify the specific package from this advisory, confirm whether it is a dev or production dependency, and update it. If it is a production dependency bundled into dist/index.js, verify that the vulnerable code path is reachable and patch immediately.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2w6w-674q-4c4q
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xjpj-3mr7-gcpf applies
Minor caution · low confidence
A scanner flagged a vulnerable package version. The flagged package is probably a development tool that does not run when users use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xjpj-3mr7-gcpf to a dependency declared by this repository.
Contextual assessment: This advisory matches a lockfile dependency. The project's architecture bundles production code into dist/index.js via webpack, and the manifest references that pre-built artifact. Development dependencies do not ship to users. The three production dependencies are at current patched versions, so this advisory most likely targets a transitive build-time dependency.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xjpj-3mr7-gcpf
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v56q-mh7h-f735 applies
Minor caution · low confidence
A scanner found a vulnerable package version in the dependency list. Since the extension ships pre-built files, this is likely a development-only dependency that does not affect users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.
Contextual assessment: This advisory matches a lockfile dependency. The extension loads pre-built dist/index.js per its manifest. The development toolchain (babel, jest, webpack, sass, typescript, loaders) is used only during the build process and does not execute at runtime for end users. Production dependencies are minimal and at recent versions. Without the specific lockfile entry, this advisory most likely targets a build-time dependency.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v56q-mh7h-f735
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7p8r-x3mc-p8w7 applies
Minor caution · medium confidence
A scanner flagged an outdated development tool package. Because this is a browser extension, the flagged tool is used only to build the code on the developer's machine and is not included in what users install, so it does not create a direct danger for extension users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency declared in this lockfile. The project is a SillyTavern browser extension whose shipped artifact is a webpack bundle (dist/index.js). The root package declares only fast-xml-parser, handlebars, and sillytavern-utils-lib as production dependencies; all babel, jest, webpack, sass, and typescript packages are devDependencies used during build. The advisory most likely targets a dev-only or transitive build-tool package that does not ship to end users and has no runtime reachability in the deployed extension. No attacker-controlled input reaches build-time tooling during normal use.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient to keep the build environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7p8r-x3mc-p8w7
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7r86-cg39-jmmj applies
Minor caution · medium confidence
A scanner flagged an outdated development or build tool. Since it is not part of the installed extension, it does not directly endanger users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project ships a webpack bundle to SillyTavern users; build and test tooling (babel, jest, webpack, sass, typescript) are devDependencies that are not bundled into the runtime extension. The advisory likely targets a build-tool or transitive dev package without runtime reachability in the deployed artifact. No untrusted user input flows into these tools at runtime.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7r86-cg39-jmmj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-6g55-p6wh-862q applies
Minor caution · medium confidence
A scanner flagged an outdated development tool. It is used only during the build process and is not included in the extension users install, so it poses no direct risk to them.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The extension's production dependencies are limited to fast-xml-parser, handlebars, and sillytavern-utils-lib; the remaining packages visible in the lockfile are devDependencies for building and testing. The advisory most likely corresponds to a dev-only package that is not shipped to end users and has no runtime path in the deployed browser extension.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-6g55-p6wh-862q
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-8fgc-7cc6-rx7x applies
Minor caution · medium confidence
A scanner flagged a minor issue in a development tool. It is not part of the installed extension and the severity is low, so it does not create a meaningful risk for users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8fgc-7cc6-rx7x to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. Given the project structure, the flagged package is most likely a dev or build dependency not present in the shipped webpack bundle. Low advisory severity and the absence of runtime reachability in the deployed extension limit user impact.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8fgc-7cc6-rx7x
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · medium confidence
A scanner flagged an outdated build or test tool. Because it is not included in the extension that users install, it does not directly threaten them.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project is a browser extension that ships a webpack bundle; the lockfile shows extensive babel, jest, and webpack devDependencies that do not ship to end users. The advisory most likely targets a build-tool or transitive dev package without runtime reachability in the deployed extension.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xhpv-hc6g-r9c6 applies
Minor caution · medium confidence
A scanner flagged an outdated development tool. It is used only to build the extension and is not shipped to users, so it does not create a direct risk.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xhpv-hc6g-r9c6 to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The extension's runtime artifact is a webpack bundle built from a small set of production dependencies; the lockfile is dominated by devDependencies for babel, jest, webpack, sass, and typescript. The advisory most likely corresponds to a dev-only package that is not bundled into the shipped extension and has no runtime exposure to untrusted input.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xhpv-hc6g-r9c6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xvcm-6775-5m9r applies
Minor caution · medium confidence
A scanner flagged an outdated build or test tool. Since it is not part of the installed extension, it does not directly endanger users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project ships a webpack bundle to SillyTavern users; build and test tooling are devDependencies not included in the runtime extension. The advisory most likely targets a build-tool or transitive dev package without runtime reachability in the deployed artifact.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xvcm-6775-5m9r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3v7f-55p6-f55p applies
Minor caution · medium confidence
A scanner flagged a medium-severity issue in a development tool. It is not part of the extension users install, so it does not create a meaningful risk for them.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.
Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. Given the project structure, the flagged package is most likely a dev or build dependency not present in the shipped webpack bundle. The advisory has no runtime reachability in the deployed browser extension and no attacker-controlled input reaches the relevant code at runtime.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3v7f-55p6-f55p
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3mfm-83xf-c92r applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package listed in the project's dependency lockfile. This package is most likely a build tool used only during development, not something included in the extension that users actually run. The vulnerability does not appear to affect the shipped extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3mfm-83xf-c92r to a dependency declared by this repository.
Contextual assessment: This advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact to SillyTavern users; node_modules are not distributed. The visible lockfile portion shows the dependency tree is dominated by build-time devDependencies (babel, webpack, jest, sass, typescript). The three production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for any of those packages. The advisory most likely targets a transitive dev dependency used only during build. The vulnerable code would not be present in the shipped browser extension bundle, and no attacker-controlled input reaches build-time tooling at runtime.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it to a fixed version as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3mfm-83xf-c92r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4c8g-83qw-93j6 applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.
Contextual assessment: This advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4c8g-83qw-93j6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-f886-m6hf-6m8v applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-f886-m6hf-6m8v
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fj3w-jwp8-x2g3 applies
Minor caution · medium confidence
A security scanner found a low-severity vulnerability in a package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fj3w-jwp8-x2g3 to a dependency declared by this repository.
Contextual assessment: This low-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency not present in the shipped browser extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fj3w-jwp8-x2g3
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-qx2v-qp2m-jg93 applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-qx2v-qp2m-jg93
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-52cp-r559-cp3m applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-52cp-r559-cp3m
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3ppc-4f35-3m26 applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3ppc-4f35-3m26
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Minor caution · medium confidence
This flagged dependency is part of the development tooling used to build the extension, not something included in the extension that users install. The vulnerable code never runs when the extension is used in SillyTavern. Updating the dependency is good hygiene for the developer but poses no direct risk to users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: This advisory corresponds to a transitive dependency resolved in the lockfile. The project's three production dependencies (fast-xml-parser 5.x, handlebars 4.7.8, sillytavern-utils-lib 1.x) are at current versions with no known matching advisories. The advisory is therefore almost certainly for a dev/build tool dependency (babel, webpack, jest, sass, or their transitive packages). The extension ships a bundled dist/index.js; dev dependencies are not included in the shipped artifact and have no runtime reachability for end users. Attacker-controlled input cannot reach the vulnerable code during extension execution. The only theoretical concern is build-time supply-chain risk to the developer, which requires a separate compromise vector.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient to keep the build environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-442j-39wm-28r2 applies
Minor caution · medium confidence
This is a low-severity issue in a development-only dependency that is not included in the extension users install. It does not affect the running extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-442j-39wm-28r2 to a dependency declared by this repository.
Contextual assessment: This low-severity advisory matches a dependency in the lockfile. The project's production dependencies are at versions with no known advisories, so this match is for a dev or build transitive dependency. The extension is distributed as a bundled artifact, meaning dev dependencies do not ship to end users and the vulnerable code has no runtime reachability in the installed extension. No attacker-controlled input reaches the vulnerable code during extension operation.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-442j-39wm-28r2
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-c2c7-rcm5-vvqj applies
Minor caution · medium confidence
Although this advisory is rated high severity, the vulnerable package is part of the development tooling and is not included in the extension that users install. The vulnerable code never runs during normal use of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency. The project's production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) are at current patched versions with no matching advisories. The advisory therefore targets a dev/build transitive dependency. The shipped extension is a webpack bundle that excludes dev dependencies, so the vulnerable code has no runtime reachability for end users. Build-time exploitation would require a separate attacker capability to inject malicious input into the developer's build process.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version to maintain a clean build environment.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-c2c7-rcm5-vvqj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2qvq-rjwj-gvw9 applies
Minor caution · medium confidence
This is a medium-severity issue in a development-only dependency that does not ship with the extension. It does not affect users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2qvq-rjwj-gvw9 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a lockfile dependency. The production dependencies are at safe current versions, so this advisory is for a dev or build transitive dependency. The extension ships as a bundle without dev dependencies, giving the vulnerable code no runtime reachability in the installed extension. No attacker-controlled input reaches the vulnerable code during extension execution.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2qvq-rjwj-gvw9
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-38r7-794h-5758 applies
Minor caution · medium confidence
This is a low-severity issue in a development-only dependency that is not included in the extension users install.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-38r7-794h-5758 to a dependency declared by this repository.
Contextual assessment: This low-severity advisory matches a lockfile dependency. The project's production dependencies are at current versions with no matching advisories, so this is a dev or build transitive dependency. The shipped bundle excludes dev dependencies, so the vulnerable code has no runtime reachability for end users.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-38r7-794h-5758
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · medium confidence
Although rated high severity, the vulnerable package is part of the development tooling and is not shipped with the extension. The vulnerable code does not run when the extension is used in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency. The production dependencies (fast-xml-parser 5.x, handlebars 4.7.8, sillytavern-utils-lib 1.x) are at current versions with no known matching advisories, so this advisory targets a dev or build transitive dependency. The extension is distributed as a webpack bundle that does not include dev dependencies, so the vulnerable code has no runtime reachability for end users. Exploitation would require attacker control over the developer's build environment.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version to keep the build environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Expected scanner matches (0)
None.