OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension lets users write custom template logic to transform tracker data. This code runs that user-supplied logic on their own machine using their own data. This is a normal feature for a customizable template system and does not send data anywhere or access anything unexpected.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched construct uses `new Function` to execute template logic stored in `currentTemplateLogic`, which is imported from the project's own templating module and represents user-configured template transformation code. The function receives parsed tracker data and returns transformed data, with error handling that falls back to the original data. This is a standard pattern for a template engine that supports custom logic, consistent with the project's stated purpose of customizable templates. The code executes locally within the user's own SillyTavern instance on data derived from their own character messages. No network exfiltration, credential access, or concealed execution is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- renderer.js:635