A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The code reads saved settings from SillyTavern's own local API and writes CSS theme colors back into the interface. This is normal behavior for a theme management extension. No harmful code execution or remote data download is involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive with a code execution sink in the same file. The retrieval is a fetch to the local SillyTavern endpoint /api/settings/get using getRequestHeaders, which is standard for a SillyTavern extension reading saved settings. The fetch interceptor at line 376 only targets /api/themes/save to attach PTMT theme color data before delegating to the original fetch. The innerHTML assignment at line 165 writes CSS rule text derived from the stylesheet's own cssRules collection back into a style element and the SillyTavern custom CSS textarea. No remote attacker-controlled data flows into an execution sink; all inputs are local SillyTavern API responses and internally generated CSS strings. This matches the extension's stated theme integration purpose.
The flagged regular expression is a simple pattern for reading CSS color values. It does not have the structure that causes performance problems, and the input comes from the browser's own color resolution, not from any external attacker.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged an unsafe-regex signal on line 139. The regex at that line is a CSS rgba color parser with a straightforward linear alternation of separators and bounded capture groups. It lacks nested quantifiers or overlapping alternatives that could cause catastrophic backtracking. The input is a resolved CSS color string from getComputedStyle, not attacker-controlled data. No ReDoS risk is demonstrated.
The scanner thought it found a secret, but line 40 only contains a normal comparison of a settings name. There is no password or API key in this code.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key rule matched on line 40, but the visible source at that line contains only a conditional comparison of a setting key string. No credential, token, password, or API key value is present anywhere in the supplied code. The match is a false positive on a configuration key name.