A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The tool saw both a network request and something that can change program behavior, and flagged the combination. In reality, the extension only fetches the user's own saved color themes from the local SillyTavern server and applies the colors to the interface; it never runs downloaded data as code. The behavior-tweaking code is a short-lived trick to keep the color pickers in sync, not hidden execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The file does contain both a network retrieval (a same-origin POST to the local SillyTavern settings API to read the user's saved theme list) and constructs a scanner treats as execution sinks, but no retrieved data is executed as code. The fetched response is used only to locate a named theme and copy its color strings into CSS custom properties and color-picker attributes. The other flagged constructs are a temporary per-element override of the change-event dispatch method (reverted on the next animation frame, scoped to one picker element) and writes to style properties, neither of which executes fetched content. The fetch wrapper that intercepts theme-save requests only appends theme color keys to the outgoing request body on the same origin. All flows are same-origin, match the stated theme-integration purpose, and involve no untrusted content reaching a code-execution path.
A pattern used to read color values from the browser was flagged as potentially slow on hostile input. The input is always a short, standardized color string produced by the browser itself, so there is no realistic way for anyone to make it hang.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regexes parse browser-computed color strings. Their inputs are produced by the CSS engine via a computed-style read on a temporary element, which yields short, normalized rgb/rgba/color() or hex strings rather than arbitrary attacker-controlled text. While the alternation-heavy patterns are not linear-time, the bounded and well-formed input space makes catastrophic backtracking implausible, and no attacker-controlled path to these regexes is demonstrated. At worst a malformed computed color would cause a quick failed match, not a hang.
A scanner thought the code might be deliberately hidden or disguised. Reading the actual file shows completely normal, readable code that builds settings checkboxes and saves user preferences. Nothing is hidden or disguised.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner raised a low-confidence obfuscation signal, but the supplied source is plain, readable, idiomatic JavaScript: ES module imports, DOM construction helpers, checkbox change handlers, and settings persistence. There is no encoded payload, eval-style execution, string assembly of code, or concealment of any kind. The flagged representation is the raw source at transform depth 0, so the signal is a false positive on ordinary code. All behavior shown matches the extension's stated layout-management purpose: it toggles column visibility, moves a background element, validates CSS dimension input, and persists settings.
A secret-scanning tool flagged what looked like an API key, but the flagged text is just an internal setting name used by the extension's own checkbox logic. There is no password or key in this file.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The credential scanner matched a generic API-key pattern on the flagged line, but the supplied source at that location contains only a comparison of a settings key identifier string against a layout setting name followed by calls to DOM-rearrangement helpers. No secret, token, password, or credential literal appears anywhere in the provided source or expansions. The matched value is an internal settings key name, not an authentication credential, and no data flow sends credentials anywhere.