TavernKeeper Scan Report

NeoTavern/NeoTavern-Frontend

Commit a0d833c Reviewed

12 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 12 material 24 low

What this review found

Dependency advisory GHSA-p9ff-h696-f583 applies

Material concern · medium confidence

A serious security flaw was found in a software package this project relies on. Because the project processes content from users and AI services, a flaw like this could potentially be misused. The exact details of which package is affected were not fully visible in the provided evidence.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-p9ff-h696-f583 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-p9ff-h696-f583) against a dependency in the lockfile. The provided source excerpt shows the root package declares production dependencies used for expression parsing, HTML sanitization, markdown rendering, and API proxying. The project handles user-generated and AI-generated content, meaning attacker-controlled input may reach vulnerable code paths in production dependencies. The specific flagged package identity and resolved version were not visible in the truncated source context, so runtime reachability cannot be definitively confirmed. A high-severity advisory in a production dependency for this type of project warrants attention.

Impact: medium · Exploitability: plausible

Developer action: Run a fresh dependency audit to identify the specific package, confirm the resolved version falls within the advisory range, and update to a fixed version. Verify whether attacker-controlled input reaches the vulnerable code path in the project runtime.

Scanner
osv-scanner 2.4.0
Rule
GHSA-p9ff-h696-f583
File role
production
Source
package-lock.json

Dependency advisory GHSA-pm4m-ph32-ghv5 applies

Material concern · medium confidence

A serious security flaw was found in a package this project uses for processing content. Since the project displays content from users and AI, a flaw in content processing could potentially be exploited to cause harm.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-pm4m-ph32-ghv5 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-pm4m-ph32-ghv5) against a dependency in the lockfile. The project declares production dependencies for HTML sanitization, markdown rendering, and content templating. The project renders AI-generated and user-generated content, meaning attacker-controlled input likely reaches these code paths. A high-severity advisory in a content-processing production dependency could allow content injection or denial of service. The specific package identity and resolved version were not visible in the truncated source context, so the exact vulnerability and reachability cannot be definitively confirmed.

Impact: medium · Exploitability: plausible

Developer action: Run a fresh dependency audit to identify the specific package, confirm the resolved version, and update to a fixed version. Verify whether untrusted content reaches the vulnerable code path.

Scanner
osv-scanner 2.4.0
Rule
GHSA-pm4m-ph32-ghv5
File role
production
Source
package-lock.json

Dependency advisory GHSA-v2hh-gcrm-f6hx applies

Material concern · medium confidence

A serious security flaw was found in a package this project uses to clean untrusted content. Since the project displays content from users and AI services, a flaw in the content-cleaning component could potentially allow harmful content to slip through.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-v2hh-gcrm-f6hx) against a dependency in the lockfile. The project declares dompurify as a production dependency for HTML sanitization, and the project renders AI-generated and user-generated content. A high-severity advisory in a sanitization library is security-critical because bypasses can allow script injection in content-rendering contexts. The specific resolved version of the flagged package was not visible in the truncated source context, so it cannot be confirmed whether the declared version range resolves to a version within the advisory range or whether a transitive dependency is affected.

Impact: medium · Exploitability: plausible

Developer action: Run a fresh dependency audit to identify the specific package and resolved version. Update to a version outside the advisory range. If the affected package is a sanitization library, prioritize this update and verify that content sanitization remains effective.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2hh-gcrm-f6hx
File role
production
Source
package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6 applies

Material concern · low confidence

A security scanner found that one of the project's bundled libraries has a known security issue. The scanner did not include which specific library was affected, so the real-world risk cannot be fully confirmed, but the project's use of a local web server and AI content processing means the issue could matter.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a version that addresses the advisory. Run a dependency audit with package details visible to identify and remediate the specific package.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4c8g-83qw-93j6
File role
production
Source
package-lock.json

Dependency advisory GHSA-5p4m-2wfm-xmqj applies

Material concern · low confidence

A security scanner found a known vulnerability in one of the project's libraries. Without knowing which library is affected, the exact danger is unclear, but the project handles web content and AI responses, so the issue should be addressed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5p4m-2wfm-xmqj to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. Package details were stripped from the scanner output, and the truncated source context does not include the matching lockfile entry, preventing independent verification of the specific package, resolved version, or runtime reachability. The project serves web content locally and processes untrusted AI model output, so vulnerable parsing or rendering libraries could be exploitable depending on the package involved.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Run a dependency audit with full package details to identify the specific library and upgrade it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-5p4m-2wfm-xmqj
File role
production
Source
package-lock.json

Dependency advisory GHSA-v2wj-q39q-566r applies

Material concern · low confidence

A security scanner identified a known vulnerability in a bundled library. The specific library was not named in the scanner output, so the exact impact is uncertain, but the project's web-serving and content-processing features mean it should be fixed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2wj-q39q-566r to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. The scanner removed package details, and the provided source excerpt does not reach the matching lockfile entry, so the specific vulnerable package and its resolved version cannot be confirmed. Given the project includes production dependencies for web serving, proxying, and content rendering, a vulnerable dependency in any of these areas could present runtime risk.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a version that resolves the advisory. Use a dependency scanner that reports package names to identify and remediate the specific library.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2wj-q39q-566r
File role
production
Source
package-lock.json

Dependency advisory GHSA-4cwx-7wf7-3272 applies

Material concern · low confidence

A security scanner found a known security issue in one of the project's libraries. The affected library was not identified in the scanner results, so the precise risk is unclear, but the project's content handling means it should be addressed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Run a dependency audit with visible package details to identify and upgrade the specific library.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4cwx-7wf7-3272
File role
production
Source
package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Material concern · low confidence

A security scanner found a known vulnerability in a bundled library. The specific library was not named, so the exact danger is uncertain, but the project's web-serving and content-processing capabilities mean it should be addressed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. The scanner output does not include package details, and the provided source excerpt is truncated before the matching lockfile entry, so the specific vulnerable package, resolved version, and runtime reachability cannot be independently confirmed. The project includes production dependencies for web serving, proxy middleware, and content rendering, so a vulnerable dependency in these areas could present exploitable risk.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a version that resolves the advisory. Use a dependency scanner that reports package names to identify and remediate the specific library.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
package-lock.json

Dependency advisory GHSA-8r6m-32jq-jx6q applies

Material concern · low confidence

A security scanner found a known security issue in one of the project's libraries. The affected library was not identified in the scanner results, so the precise risk is unclear, but the project's content handling means it should be fixed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8r6m-32jq-jx6q to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a dependency in this lockfile. Package details were stripped from the scanner output, and the truncated source context does not reach the matching lockfile entry, preventing independent verification of the specific package, resolved version, or runtime reachability. The project processes AI-generated content and renders it in a browser context, so vulnerable content-handling libraries could be exploitable depending on the package involved.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Run a dependency audit with visible package details to identify and upgrade the specific library.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8r6m-32jq-jx6q
File role
production
Source
package-lock.json

Dependency advisory GHSA-2v37-7h3g-55p8 applies

Material concern · medium confidence

A known security flaw was found in one of the libraries this project uses. The project mainly runs on your own computer, which limits the danger, but it can be configured to share access over a local network. Updating the affected library to a fixed version is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8 against a dependency resolved in the lockfile with high scanner confidence, confirming the vulnerable version is present. The project declares runtime dependencies including express, http-proxy-middleware, handlebars, dompurify, marked, js-yaml, and fast-xml-parser that process user-supplied or external content. The application is primarily local-first (localhost:8787) but supports LAN exposure via host 0.0.0.0 configuration, which increases the attack surface. Without the specific package identity in the scanner output, exact runtime reachability cannot be fully traced, but the advisory is confirmed present in the shipped lockfile.

Impact: medium · Exploitability: plausible

Developer action: Identify the package matched by GHSA-2v37-7h3g-55p8 in the lockfile and upgrade it to a version that includes the fix. Run npm audit or osv-scanner after updating to confirm resolution.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2v37-7h3g-55p8
File role
production
Source
package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Material concern · medium confidence

A known security flaw was found in one of the project's libraries. Since the app can be exposed to other devices on your network, someone on the same network could potentially exploit it. Updating the library is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 against a dependency in the lockfile with high scanner confidence. The project includes multiple runtime dependencies that handle untrusted input including markdown parsing, HTML sanitization, YAML and XML parsing, and HTTP proxying. The local-first deployment model reduces exposure, but the configurable LAN mode and basic-auth option indicate the server component can face network attackers. The advisory is confirmed in the shipped dependency tree.

Impact: medium · Exploitability: plausible

Developer action: Identify the package matched by GHSA-rgw5-rvv9-x895 in the lockfile and upgrade it to a patched version. Verify the fix with osv-scanner after updating.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json

Dependency advisory GHSA-fx2h-pf6j-xcff applies

Material concern · medium confidence

A known security flaw was found in one of the project's libraries. The app handles content from user imports like character cards and chat messages, so updating the affected library is important to prevent potential exploitation.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff against a dependency in the lockfile with high scanner confidence. The project processes user-supplied content such as chat messages, character cards, and lorebooks through libraries including marked, dompurify, handlebars, and fast-xml-parser. If the advisory affects one of these content-processing libraries, attacker-controlled input from imported character cards or chat content could reach the vulnerable code path. The local deployment model limits but does not eliminate exposure.

Impact: medium · Exploitability: plausible

Developer action: Identify the package matched by GHSA-fx2h-pf6j-xcff in the lockfile and upgrade it to a patched version. Confirm resolution with osv-scanner after updating.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fx2h-pf6j-xcff
File role
production
Source
package-lock.json

Minor cautions

Dependency advisory GHSA-v6wh-96g9-6wx3 applies

Minor caution · medium confidence

A moderate security warning was found for a package used by this project. These types of issues usually have limited impact, and the package may only be used during development rather than in the live application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-v6wh-96g9-6wx3) against a dependency in the lockfile. The project declares both production and devDependencies, and several declared devDependencies are complex packages that commonly appear in advisory feeds. Medium-severity advisories in build-time or test-time dependencies do not affect the production runtime. Even if this affects a production dependency, medium-severity issues typically have limited concrete user harm. The specific package identity was not visible in the truncated source context.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. If the package is a devDependency, the priority is lower.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v6wh-96g9-6wx3
File role
production
Source
package-lock.json

Dependency advisory GHSA-jr45-8vmc-qm54 applies

Minor caution · medium confidence

A moderate security warning was found for a package used by this project. If the package is only used during development or building, it does not affect the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-jr45-8vmc-qm54) against a dependency in the lockfile. The project declares devDependencies including build tooling and test frameworks that commonly appear in advisory feeds. Medium-severity advisories in build-time dependencies do not affect the production runtime. The specific package identity and whether it is a production or dev dependency were not visible in the truncated source context.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Confirm whether the package is a production or development dependency.

Scanner
osv-scanner 2.4.0
Rule
GHSA-jr45-8vmc-qm54
File role
production
Source
package-lock.json

Dependency advisory GHSA-55q2-fjhq-7xh7 applies

Minor caution · medium confidence

A moderate security warning was found for a package this project uses. The project includes a small server component, so there is some possibility the issue could affect how requests are handled, but medium-severity issues usually have limited impact.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-55q2-fjhq-7xh7 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-55q2-fjhq-7xh7) against a dependency in the lockfile. The project declares production dependencies for server-side operations including an Express server and proxy middleware. A medium-severity advisory in server or proxy packages could have some runtime relevance if attacker-controlled requests reach the vulnerable code. However, medium-severity issues typically result in limited concrete harm such as request handling edge cases or information exposure. The specific package identity was not visible in the truncated source context.

Impact: low · Exploitability: plausible

Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Assess whether external requests can reach the vulnerable code path.

Scanner
osv-scanner 2.4.0
Rule
GHSA-55q2-fjhq-7xh7
File role
production
Source
package-lock.json

Dependency advisory GHSA-8xcm-r25x-g524 applies

Minor caution · medium confidence

A moderate security warning was found for a package used by this project. These types of issues usually have limited impact on the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-8xcm-r25x-g524) against a dependency in the lockfile. The project declares both production and devDependencies. Medium-severity advisories commonly affect build-time tooling, test frameworks, or libraries with limited attack surface such as browser detection utilities. The specific package identity was not visible in the truncated source context, so runtime reachability cannot be confirmed.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8xcm-r25x-g524
File role
production
Source
package-lock.json

Dependency advisory GHSA-4w7w-66w2-5vf9 applies

Minor caution · medium confidence

A moderate security warning was found for a package used by this project. If the package is only used during development, it does not affect the live application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-4w7w-66w2-5vf9) against a dependency in the lockfile. The project declares both production and devDependencies including test and build tooling that commonly appear in advisory feeds. Medium-severity advisories in build-time dependencies do not affect the production runtime. The specific package identity was not visible in the truncated source context.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and update if a fixed version is available. Confirm whether the package is a production or development dependency.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4w7w-66w2-5vf9
File role
production
Source
package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. Without knowing which package is affected, it is unclear whether the vulnerability can actually be exploited in this project.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-3jxr-9vmj-r5cp) against a dependency in the lockfile, but package details were removed from the scanner output. The provided source context shows only the first 641 lines of a 445 KB lockfile, covering top-level dependency declarations and mostly @babel/* dev dependencies. Without knowing which specific package and resolved version matched, runtime reachability and attacker-controlled input paths cannot be confirmed. The project declares production dependencies including express, http-proxy-middleware, dompurify, handlebars, and marked that process requests and untrusted content, so the advisory could be relevant if it targets one of those, but it could equally be a transitive dev-only dependency.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3jxr-9vmj-r5cp
File role
production
Source
package-lock.json

Dependency advisory GHSA-v56q-mh7h-f735 applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-v56q-mh7h-f735) against a dependency in the lockfile, but package details were removed. The visible lockfile context does not include the specific package or resolved version that triggered this match. The project includes both production server-side dependencies (express, http-proxy-middleware) and dev tooling (vite, vitest, jsdom, sass); without knowing which package matched, runtime reachability cannot be determined.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v56q-mh7h-f735
File role
production
Source
package-lock.json

Dependency advisory GHSA-7p8r-x3mc-p8w7 applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-7p8r-x3mc-p8w7) against a dependency in the lockfile, but package details were removed. The provided source context does not reveal which specific package or resolved version matched. Without that information, whether the vulnerable code is present in production runtime versus dev-only tooling cannot be confirmed.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7p8r-x3mc-p8w7
File role
production
Source
package-lock.json

Dependency advisory GHSA-c2j3-45gr-mqc4 applies

Minor caution · low confidence

A security scanner found a low-severity vulnerability warning for one of the project's dependencies. The specific package name was not included, but low-severity issues typically have limited impact.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a low-severity advisory (GHSA-c2j3-45gr-mqc4) against a dependency in the lockfile, but package details were removed. The low scanner severity suggests limited impact. Without knowing the specific package, runtime reachability cannot be confirmed, but low-severity advisories typically represent edge-case or limited-scope issues.

Impact: low · Exploitability: unlikely

Developer action: Identify which dependency triggered this advisory and update it to a fixed version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c2j3-45gr-mqc4
File role
production
Source
package-lock.json

Dependency advisory GHSA-28wg-ghj8-5hjv applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-28wg-ghj8-5hjv) against a dependency in the lockfile, but package details were removed. The visible source context does not include the matching package or resolved version. The project declares production dependencies that handle HTTP requests and untrusted content (express, http-proxy-middleware, dompurify, handlebars, marked), so if the advisory targets one of those, it could be relevant; if it targets a dev-only transitive dependency, it would not affect production runtime.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-28wg-ghj8-5hjv
File role
production
Source
package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-r28c-9q8g-f849) against a dependency in the lockfile, but package details were removed. Without the specific package name and resolved version, runtime reachability and attacker-controlled input paths cannot be assessed. The advisory could target a production dependency or a dev-only transitive dependency.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
package-lock.json

Dependency advisory GHSA-xvcm-6775-5m9r applies

Minor caution · low confidence

A security scanner found a known vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-xvcm-6775-5m9r) against a dependency in the lockfile, but package details were removed. The provided source context does not reveal which specific package or resolved version matched. Without that information, whether the vulnerable code is exercised in production cannot be determined.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xvcm-6775-5m9r
File role
production
Source
package-lock.json

Dependency advisory GHSA-v3r7-h72x-cjcm applies

Minor caution · low confidence

A security scanner found a medium-severity vulnerability warning for one of the project's dependencies, but the specific package name was not included in the report. It is unclear whether the vulnerability affects the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-v3r7-h72x-cjcm) against a dependency in the lockfile, but package details were removed. Without the specific package name and resolved version, runtime reachability cannot be confirmed. The project includes production dependencies that process untrusted content, so the advisory could be relevant if it targets one of those packages.

Impact: low · Exploitability: plausible

Developer action: Identify which dependency triggered this advisory, update it to a fixed version, and verify whether the vulnerable code path is reachable in production.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v3r7-h72x-cjcm
File role
production
Source
package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · low confidence

A security scanner found a moderate-level issue in one of the project's libraries. Since the app runs locally and the specific library was not identified, the practical risk appears low, but updating dependencies is still good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency when convenient. Run a dependency audit with package details to identify the specific library and upgrade it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
package-lock.json

Dependency advisory GHSA-m8rv-5g2x-5cg5 applies

Minor caution · low confidence

A security scanner found a moderate-level issue in one of the project's libraries. Since the app runs locally and the specific library was not identified, the practical risk appears low, but updating dependencies is still good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency when convenient. Run a dependency audit with package details to identify the specific library and upgrade it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m8rv-5g2x-5cg5
File role
production
Source
package-lock.json
Expected scanner matches (8)

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is just a CSS styling rule for the settings panel layout. It does not modify startup behavior or persist anything.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is inside a scoped SCSS style block and defines a CSS class selector with layout properties. There is no startup persistence, execution, or state modification of any kind. The scanner matched on the class name text, not on any executable behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:473

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is a CSS layout rule, not a startup or persistence mechanism.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is a CSS class selector inside a scoped style block containing only flexbox layout declarations. No persistence, startup, or execution logic is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:458

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is a CSS styling definition for the profile content area. It has nothing to do with startup persistence.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is a CSS class selector within a scoped SCSS block with only display and layout properties. No startup modification or persistence behavior exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:479

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a settings form definition that tells the app which API key field to show for the AI21 provider. It references a label for the key, not the key itself. No real password or secret is exposed here.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a UI configuration object that assigns a constant reference SECRET_KEYS.AI21 to a secretKey property on a key-manager widget. No literal credential value is present; the value is an imported enum constant used to identify which user-supplied API key the key-manager widget should manage. The gitleaks generic-api-key rule matched on the property name and surrounding key-related identifiers, not on an actual secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
src/api-connection-definition.ts:169

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged code is just styling for how a row of text is displayed on screen. It does not change how the app starts up or save anything persistently.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is a CSS class selector inside a Vue component style block. It defines layout properties for a profile row UI element. There is no startup modification, persistence mechanism, script execution, or data flow present. The scanner match is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/mythic-agents/components/NpcTab.vue:304

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a settings screen definition that tells the app where to let users enter their AI21 API key. It does not contain any real password or key value, just a label pointing to where the key would be stored.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a UI configuration object for an AI21 API key-manager widget. The property secretKey is assigned SECRET_KEYS.AI21, which is an imported constant from the project's constants module used as a slot identifier for the key-manager widget. No actual credential value is present in the source; the scanner matched on the property name and constant reference pattern rather than a real secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
src/api-connection-definition.ts:169

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged code is just visual styling for a section of the chat memory popup. It does not change how the app starts up or persist anything.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is a CSS style rule inside a scoped style block of a Vue popup component. It defines border, padding, and margin for a profile selector section. There is no startup modification, persistence mechanism, script execution, or data flow present. The scanner match is a false positive on static styling.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/chat-memory/MemoryPopup.vue:109

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is a CSS layout rule for profile control buttons. It does not affect startup or persistence.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The flagged line is a CSS class selector in a scoped style block containing only flexbox layout declarations. There is no executable code, persistence mechanism, or startup modification.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:464

Related contextual observations

All four candidates are CSS class definitions in a scoped style block

low risk · high confidence

Every flagged line is just CSS styling code for arranging UI elements. None of them modify startup behavior or persist data.

Technical assessment

All four flagged lines fall within the scoped SCSS style section of a Vue single-file component. Each is a CSS class selector with only layout properties such as display, flex-direction, gap, and padding. The scanner rule appears to have matched on class names containing words like management, controls, actions, and content, producing false positives with no executable or persistence-relevant code.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity