What this review found
Dependency advisory GHSA-p9ff-h696-f583 applies
Material concern · medium confidence
A serious security flaw was found in a software package this project relies on. Because the project processes content from users and AI services, a flaw like this could potentially be misused. The exact details of which package is affected were not fully visible in the provided evidence.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-p9ff-h696-f583 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-p9ff-h696-f583) against a dependency in the lockfile. The provided source excerpt shows the root package declares production dependencies used for expression parsing, HTML sanitization, markdown rendering, and API proxying. The project handles user-generated and AI-generated content, meaning attacker-controlled input may reach vulnerable code paths in production dependencies. The specific flagged package identity and resolved version were not visible in the truncated source context, so runtime reachability cannot be definitively confirmed. A high-severity advisory in a production dependency for this type of project warrants attention.
Impact: medium · Exploitability: plausible
Developer action: Run a fresh dependency audit to identify the specific package, confirm the resolved version falls within the advisory range, and update to a fixed version. Verify whether attacker-controlled input reaches the vulnerable code path in the project runtime.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-p9ff-h696-f583
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-pm4m-ph32-ghv5 applies
Material concern · medium confidence
A serious security flaw was found in a package this project uses for processing content. Since the project displays content from users and AI, a flaw in content processing could potentially be exploited to cause harm.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-pm4m-ph32-ghv5 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-pm4m-ph32-ghv5) against a dependency in the lockfile. The project declares production dependencies for HTML sanitization, markdown rendering, and content templating. The project renders AI-generated and user-generated content, meaning attacker-controlled input likely reaches these code paths. A high-severity advisory in a content-processing production dependency could allow content injection or denial of service. The specific package identity and resolved version were not visible in the truncated source context, so the exact vulnerability and reachability cannot be definitively confirmed.
Impact: medium · Exploitability: plausible
Developer action: Run a fresh dependency audit to identify the specific package, confirm the resolved version, and update to a fixed version. Verify whether untrusted content reaches the vulnerable code path.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-pm4m-ph32-ghv5
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v2hh-gcrm-f6hx applies
Material concern · medium confidence
A serious security flaw was found in a package this project uses to clean untrusted content. Since the project displays content from users and AI services, a flaw in the content-cleaning component could potentially allow harmful content to slip through.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-v2hh-gcrm-f6hx) against a dependency in the lockfile. The project declares dompurify as a production dependency for HTML sanitization, and the project renders AI-generated and user-generated content. A high-severity advisory in a sanitization library is security-critical because bypasses can allow script injection in content-rendering contexts. The specific resolved version of the flagged package was not visible in the truncated source context, so it cannot be confirmed whether the declared version range resolves to a version within the advisory range or whether a transitive dependency is affected.
Impact: medium · Exploitability: plausible
Developer action: Run a fresh dependency audit to identify the specific package and resolved version. Update to a version outside the advisory range. If the affected package is a sanitization library, prioritize this update and verify that content sanitization remains effective.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v2hh-gcrm-f6hx
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4c8g-83qw-93j6 applies
Material concern · low confidence
A security scanner found that one of the project's bundled libraries has a known security issue. The scanner did not include which specific library was affected, so the real-world risk cannot be fully confirmed, but the project's use of a local web server and AI content processing means the issue could matter.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a version that addresses the advisory. Run a dependency audit with package details visible to identify and remediate the specific package.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4c8g-83qw-93j6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-5p4m-2wfm-xmqj applies
Material concern · low confidence
A security scanner found a known vulnerability in one of the project's libraries. Without knowing which library is affected, the exact danger is unclear, but the project handles web content and AI responses, so the issue should be addressed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-5p4m-2wfm-xmqj to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. Package details were stripped from the scanner output, and the truncated source context does not include the matching lockfile entry, preventing independent verification of the specific package, resolved version, or runtime reachability. The project serves web content locally and processes untrusted AI model output, so vulnerable parsing or rendering libraries could be exploitable depending on the package involved.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a patched version. Run a dependency audit with full package details to identify the specific library and upgrade it.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-5p4m-2wfm-xmqj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v2wj-q39q-566r applies
Material concern · low confidence
A security scanner identified a known vulnerability in a bundled library. The specific library was not named in the scanner output, so the exact impact is uncertain, but the project's web-serving and content-processing features mean it should be fixed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2wj-q39q-566r to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. The scanner removed package details, and the provided source excerpt does not reach the matching lockfile entry, so the specific vulnerable package and its resolved version cannot be confirmed. Given the project includes production dependencies for web serving, proxying, and content rendering, a vulnerable dependency in any of these areas could present runtime risk.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a version that resolves the advisory. Use a dependency scanner that reports package names to identify and remediate the specific library.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v2wj-q39q-566r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4cwx-7wf7-3272 applies
Material concern · low confidence
A security scanner found a known security issue in one of the project's libraries. The affected library was not identified in the scanner results, so the precise risk is unclear, but the project's content handling means it should be addressed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a patched version. Run a dependency audit with visible package details to identify and upgrade the specific library.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4cwx-7wf7-3272
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Material concern · low confidence
A security scanner found a known vulnerability in a bundled library. The specific library was not named, so the exact danger is uncertain, but the project's web-serving and content-processing capabilities mean it should be addressed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. The scanner output does not include package details, and the provided source excerpt is truncated before the matching lockfile entry, so the specific vulnerable package, resolved version, and runtime reachability cannot be independently confirmed. The project includes production dependencies for web serving, proxy middleware, and content rendering, so a vulnerable dependency in these areas could present exploitable risk.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a version that resolves the advisory. Use a dependency scanner that reports package names to identify and remediate the specific library.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-8r6m-32jq-jx6q applies
Material concern · low confidence
A security scanner found a known security issue in one of the project's libraries. The affected library was not identified in the scanner results, so the precise risk is unclear, but the project's content handling means it should be fixed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8r6m-32jq-jx6q to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. Package details were stripped from the scanner output, and the truncated source context does not reach the matching lockfile entry, preventing independent verification of the specific package, resolved version, or runtime reachability. The project processes AI-generated content and renders it in a browser context, so vulnerable content-handling libraries could be exploitable depending on the package involved.
Impact: medium · Exploitability: plausible
Developer action: Update the affected dependency to a patched version. Run a dependency audit with visible package details to identify and upgrade the specific library.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8r6m-32jq-jx6q
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2v37-7h3g-55p8 applies
Material concern · medium confidence
A known security flaw was found in one of the libraries this project uses. The project mainly runs on your own computer, which limits the danger, but it can be configured to share access over a local network. Updating the affected library to a fixed version is recommended.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8 against a dependency resolved in the lockfile with high scanner confidence, confirming the vulnerable version is present. The project declares runtime dependencies including express, http-proxy-middleware, handlebars, dompurify, marked, js-yaml, and fast-xml-parser that process user-supplied or external content. The application is primarily local-first (localhost:8787) but supports LAN exposure via host 0.0.0.0 configuration, which increases the attack surface. Without the specific package identity in the scanner output, exact runtime reachability cannot be fully traced, but the advisory is confirmed present in the shipped lockfile.
Impact: medium · Exploitability: plausible
Developer action: Identify the package matched by GHSA-2v37-7h3g-55p8 in the lockfile and upgrade it to a version that includes the fix. Run npm audit or osv-scanner after updating to confirm resolution.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2v37-7h3g-55p8
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Material concern · medium confidence
A known security flaw was found in one of the project's libraries. Since the app can be exposed to other devices on your network, someone on the same network could potentially exploit it. Updating the library is recommended.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 against a dependency in the lockfile with high scanner confidence. The project includes multiple runtime dependencies that handle untrusted input including markdown parsing, HTML sanitization, YAML and XML parsing, and HTTP proxying. The local-first deployment model reduces exposure, but the configurable LAN mode and basic-auth option indicate the server component can face network attackers. The advisory is confirmed in the shipped dependency tree.
Impact: medium · Exploitability: plausible
Developer action: Identify the package matched by GHSA-rgw5-rvv9-x895 in the lockfile and upgrade it to a patched version. Verify the fix with osv-scanner after updating.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fx2h-pf6j-xcff applies
Material concern · medium confidence
A known security flaw was found in one of the project's libraries. The app handles content from user imports like character cards and chat messages, so updating the affected library is important to prevent potential exploitation.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff against a dependency in the lockfile with high scanner confidence. The project processes user-supplied content such as chat messages, character cards, and lorebooks through libraries including marked, dompurify, handlebars, and fast-xml-parser. If the advisory affects one of these content-processing libraries, attacker-controlled input from imported character cards or chat content could reach the vulnerable code path. The local deployment model limits but does not eliminate exposure.
Impact: medium · Exploitability: plausible
Developer action: Identify the package matched by GHSA-fx2h-pf6j-xcff in the lockfile and upgrade it to a patched version. Confirm resolution with osv-scanner after updating.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fx2h-pf6j-xcff
- File role
- production
- Source
- package-lock.json
Minor cautions
Dependency advisory GHSA-v6wh-96g9-6wx3 applies
Minor caution · medium confidence
A moderate security warning was found for a package used by this project. These types of issues usually have limited impact, and the package may only be used during development rather than in the live application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-v6wh-96g9-6wx3) against a dependency in the lockfile. The project declares both production and devDependencies, and several declared devDependencies are complex packages that commonly appear in advisory feeds. Medium-severity advisories in build-time or test-time dependencies do not affect the production runtime. Even if this affects a production dependency, medium-severity issues typically have limited concrete user harm. The specific package identity was not visible in the truncated source context.
Impact: low · Exploitability: unlikely
Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. If the package is a devDependency, the priority is lower.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v6wh-96g9-6wx3
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-jr45-8vmc-qm54 applies
Minor caution · medium confidence
A moderate security warning was found for a package used by this project. If the package is only used during development or building, it does not affect the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-jr45-8vmc-qm54) against a dependency in the lockfile. The project declares devDependencies including build tooling and test frameworks that commonly appear in advisory feeds. Medium-severity advisories in build-time dependencies do not affect the production runtime. The specific package identity and whether it is a production or dev dependency were not visible in the truncated source context.
Impact: low · Exploitability: unlikely
Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Confirm whether the package is a production or development dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-jr45-8vmc-qm54
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-55q2-fjhq-7xh7 applies
Minor caution · medium confidence
A moderate security warning was found for a package this project uses. The project includes a small server component, so there is some possibility the issue could affect how requests are handled, but medium-severity issues usually have limited impact.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-55q2-fjhq-7xh7 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-55q2-fjhq-7xh7) against a dependency in the lockfile. The project declares production dependencies for server-side operations including an Express server and proxy middleware. A medium-severity advisory in server or proxy packages could have some runtime relevance if attacker-controlled requests reach the vulnerable code. However, medium-severity issues typically result in limited concrete harm such as request handling edge cases or information exposure. The specific package identity was not visible in the truncated source context.
Impact: low · Exploitability: plausible
Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Assess whether external requests can reach the vulnerable code path.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-55q2-fjhq-7xh7
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-8xcm-r25x-g524 applies
Minor caution · medium confidence
A moderate security warning was found for a package used by this project. These types of issues usually have limited impact on the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-8xcm-r25x-g524) against a dependency in the lockfile. The project declares both production and devDependencies. Medium-severity advisories commonly affect build-time tooling, test frameworks, or libraries with limited attack surface such as browser detection utilities. The specific package identity was not visible in the truncated source context, so runtime reachability cannot be confirmed.
Impact: low · Exploitability: unlikely
Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8xcm-r25x-g524
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4w7w-66w2-5vf9 applies
Minor caution · medium confidence
A moderate security warning was found for a package used by this project. If the package is only used during development, it does not affect the live application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-4w7w-66w2-5vf9) against a dependency in the lockfile. The project declares both production and devDependencies including test and build tooling that commonly appear in advisory feeds. Medium-severity advisories in build-time dependencies do not affect the production runtime. The specific package identity was not visible in the truncated source context.
Impact: low · Exploitability: unlikely
Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Confirm whether the package is a production or development dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4w7w-66w2-5vf9
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. Without knowing which package is affected, it is unclear whether the vulnerability can actually be exploited in this project.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-3jxr-9vmj-r5cp) against a dependency in the lockfile, but package details were removed from the scanner output. The provided source context shows only the first 641 lines of a 445 KB lockfile, covering top-level dependency declarations and mostly @babel/* dev dependencies. Without knowing which specific package and resolved version matched, runtime reachability and attacker-controlled input paths cannot be confirmed. The project declares production dependencies including express, http-proxy-middleware, dompurify, handlebars, and marked that process requests and untrusted content, so the advisory could be relevant if it targets one of those, but it could equally be a transitive dev-only dependency.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v56q-mh7h-f735 applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-v56q-mh7h-f735) against a dependency in the lockfile, but package details were removed. The visible lockfile context does not include the specific package or resolved version that triggered this match. The project includes both production server-side dependencies (express, http-proxy-middleware) and dev tooling (vite, vitest, jsdom, sass); without knowing which package matched, runtime reachability cannot be determined.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v56q-mh7h-f735
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7p8r-x3mc-p8w7 applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-7p8r-x3mc-p8w7) against a dependency in the lockfile, but package details were removed. The provided source context does not reveal which specific package or resolved version matched. Without that information, whether the vulnerable code is present in production runtime versus dev-only tooling cannot be confirmed.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7p8r-x3mc-p8w7
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-c2j3-45gr-mqc4 applies
Minor caution · low confidence
A security scanner found a low-severity vulnerability warning for one of the project's dependencies. The specific package name was not included, but low-severity issues typically have limited impact.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a low-severity advisory (GHSA-c2j3-45gr-mqc4) against a dependency in the lockfile, but package details were removed. The low scanner severity suggests limited impact. Without knowing the specific package, runtime reachability cannot be confirmed, but low-severity advisories typically represent edge-case or limited-scope issues.
Impact: low · Exploitability: unlikely
Developer action: Identify which dependency triggered this advisory and update it to a fixed version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-c2j3-45gr-mqc4
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-28wg-ghj8-5hjv applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-28wg-ghj8-5hjv) against a dependency in the lockfile, but package details were removed. The visible source context does not include the matching package or resolved version. The project declares production dependencies that handle HTTP requests and untrusted content (express, http-proxy-middleware, dompurify, handlebars, marked), so if the advisory targets one of those, it could be relevant; if it targets a dev-only transitive dependency, it would not affect production runtime.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-28wg-ghj8-5hjv
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-r28c-9q8g-f849) against a dependency in the lockfile, but package details were removed. Without the specific package name and resolved version, runtime reachability and attacker-controlled input paths cannot be assessed. The advisory could target a production dependency or a dev-only transitive dependency.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xvcm-6775-5m9r applies
Minor caution · low confidence
A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-xvcm-6775-5m9r) against a dependency in the lockfile, but package details were removed. The provided source context does not reveal which specific package or resolved version matched. Without that information, whether the vulnerable code is exercised in production cannot be determined.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xvcm-6775-5m9r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v3r7-h72x-cjcm applies
Minor caution · low confidence
A security scanner found a medium-severity vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-v3r7-h72x-cjcm) against a dependency in the lockfile, but package details were removed. Without the specific package name and resolved version, runtime reachability cannot be confirmed. The project includes production dependencies that process untrusted content, so the advisory could be relevant if it targets one of those packages.
Impact: low · Exploitability: plausible
Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v3r7-h72x-cjcm
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · low confidence
A security scanner found a moderate-level issue in one of the project's libraries. Since the app runs locally and the specific library was not identified, the practical risk appears low, but updating dependencies is still good practice.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency when convenient. Run a dependency audit with package details to identify the specific library and upgrade it.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-m8rv-5g2x-5cg5 applies
Minor caution · low confidence
A security scanner found a moderate-level issue in one of the project's libraries. Since the app runs locally and the specific library was not identified, the practical risk appears low, but updating dependencies is still good practice.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency when convenient. Run a dependency audit with package details to identify the specific library and upgrade it.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-m8rv-5g2x-5cg5
- File role
- production
- Source
- package-lock.json
Expected scanner matches (8)
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is just a CSS styling rule for the settings panel layout. It does not modify startup behavior or persist anything.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is inside a scoped SCSS style block and defines a CSS class selector with layout properties. There is no startup persistence, execution, or state modification of any kind. The scanner matched on the class name text, not on any executable behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/model-randomizer/SettingsPanel.vue:473
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a CSS layout rule, not a startup or persistence mechanism.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS class selector inside a scoped style block containing only flexbox layout declarations. No persistence, startup, or execution logic is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/model-randomizer/SettingsPanel.vue:458
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a CSS styling definition for the profile content area. It has nothing to do with startup persistence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS class selector within a scoped SCSS block with only display and layout properties. No startup modification or persistence behavior exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/model-randomizer/SettingsPanel.vue:479
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a settings form definition that tells the app which API key field to show for the AI21 provider. It references a label for the key, not the key itself. No real password or secret is exposed here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a UI configuration object that assigns a constant reference SECRET_KEYS.AI21 to a secretKey property on a key-manager widget. No literal credential value is present; the value is an imported enum constant used to identify which user-supplied API key the key-manager widget should manage. The gitleaks generic-api-key rule matched on the property name and surrounding key-related identifiers, not on an actual secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- src/api-connection-definition.ts:169
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
The flagged code is just styling for how a row of text is displayed on screen. It does not change how the app starts up or save anything persistently.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS class selector inside a Vue component style block. It defines layout properties for a profile row UI element. There is no startup modification, persistence mechanism, script execution, or data flow present. The scanner match is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/mythic-agents/components/NpcTab.vue:304
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a settings screen definition that tells the app where to let users enter their AI21 API key. It does not contain any real password or key value, just a label pointing to where the key would be stored.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a UI configuration object for an AI21 API key-manager widget. The property secretKey is assigned SECRET_KEYS.AI21, which is an imported constant from the project's constants module used as a slot identifier for the key-manager widget. No actual credential value is present in the source; the scanner matched on the property name and constant reference pattern rather than a real secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- src/api-connection-definition.ts:169
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
The flagged code is just visual styling for a section of the chat memory popup. It does not change how the app starts up or persist anything.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS style rule inside a scoped style block of a Vue popup component. It defines border, padding, and margin for a profile selector section. There is no startup modification, persistence mechanism, script execution, or data flow present. The scanner match is a false positive on static styling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/chat-memory/MemoryPopup.vue:109
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a CSS layout rule for profile control buttons. It does not affect startup or persistence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS class selector in a scoped style block containing only flexbox layout declarations. There is no executable code, persistence mechanism, or startup modification.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- src/extensions/built-in/model-randomizer/SettingsPanel.vue:464