Mnehmos/mnehmos.quest-keeper.game

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The checkout action persists the default GITHUB_TOKEN in the local git config by default. This workflow performs no subsequent git push or remote operations and uploads no artifacts, so the persisted credential has no reachable exfiltration path. The token is also short-lived and repo-scoped.

Impact: low · Exploitability: unlikely

Developer action: Add persist-credentials: false to the checkout step if no git remote operations are needed in this job.

Scanner

zizmor 1.28.0

Rule

artipacked

File role

tooling

Source

.github/workflows/ci.yml:13

Scanner reason: OSV-Scanner matched advisory GHSA-p9ff-h696-f583 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency declared in the lockfile. The supplied lockfile context shows this is a Tauri desktop frontend project where many visible transitive dependencies (CSS tooling, Babel, esbuild, testing libraries) are marked dev-only and do not ship to end users. The scanner removed specific package details, so the exact vulnerable package and its production versus dev classification cannot be confirmed from the supplied evidence. Without confirming the vulnerable code is in a production dependency reachable by attacker-controlled input, the concrete user-harm path remains unestablished for this local desktop application.

Impact: low · Exploitability: unlikely

Developer action: Run an updated dependency audit to identify the specific package and version, then upgrade if a fix is available. Prioritize production dependencies over dev-only dependencies.

Scanner

osv-scanner 2.4.0

Rule

GHSA-p9ff-h696-f583

File role

production

Source

package-lock.json

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references actions/checkout using a floating major-version tag rather than a SHA digest. If the tag were ever moved to a malicious commit, the checkout step could execute arbitrary code in the build job. This is an official GitHub action so tag compromise is unlikely, but SHA pinning is the recommended hardening practice.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/release.yml:18

Scanner reason: OSV-Scanner matched advisory GHSA-5xrq-8626-4rwp to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a critical-severity advisory against a dependency in the lockfile. The visible lockfile portion shows several dev-only packages (e.g., CSS tooling at version 4.4.4 marked dev true) that are common targets for critical ReDoS-style advisories. If the matched package is a dev-only build tool, the vulnerable code is not present in the shipped Tauri application. The scanner removed package details, preventing confirmation of whether the vulnerable package is a production dependency with runtime reachability. For a local desktop app, even a critical advisory in a dev dependency does not create an end-user attack path.

Impact: medium · Exploitability: unlikely

Developer action: Identify the specific package flagged by this critical advisory and upgrade it promptly. If it is a dev-only dependency, the urgency is lower but the upgrade should still be performed to protect the development environment.

Scanner

osv-scanner 2.4.0

Rule

GHSA-5xrq-8626-4rwp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-wrw7-89jp-8q8g to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-wrw7-89jp-8q8g against a dependency declared in this Cargo.lock. The advisory is rated medium severity. The supplied evidence does not include the affected package name or version, and the Cargo.lock source is truncated, preventing definitive identification of the vulnerable crate. This is a Tauri desktop RPG application, so the attack surface is local rather than internet-exposed. No evidence is supplied showing that attacker-controlled input reaches the vulnerable code path at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

GHSA-wrw7-89jp-8q8g

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-7gmj-67g7-phm9 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-7gmj-67g7-phm9 against a dependency in this Cargo.lock at medium severity. Package details were stripped from the scanner output, and the provided Cargo.lock excerpt is truncated, so the specific affected crate cannot be confirmed. The project is a local Tauri desktop application with no evidence of external input reaching the vulnerable dependency at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7gmj-67g7-phm9

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a lockfile dependency. The project is a Tauri desktop frontend with a mix of production and dev-only transitive dependencies. The scanner removed package details, so the specific vulnerable package, its version, and whether it is a production or dev dependency cannot be confirmed. Without that mapping, runtime reachability and attacker-controlled input paths cannot be established, keeping the risk low for this local application context.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and upgrade if a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

GHSA-v6wh-96g9-6wx3

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a lockfile dependency. Low-severity advisories typically describe issues with minimal practical impact or require highly constrained conditions. The scanner removed package details, preventing confirmation of the specific package and its production versus dev classification. For a local desktop application, the risk from a low-severity dependency advisory is minimal.

Impact: low · Exploitability: unlikely

Developer action: Upgrade the affected package when convenient. No urgent action is required for a low-severity advisory.

Scanner

osv-scanner 2.4.0

Rule

GHSA-4x5r-pxfx-6jf8

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0098 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2025-0098 against a dependency in this Cargo.lock at medium severity. The affected package identity is not included in the scanner evidence, and the Cargo.lock source excerpt is truncated, preventing confirmation of which crate is involved. This is a local desktop Tauri application; no runtime reachability or attacker-input path to the vulnerable code is demonstrated by the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0098

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The workflow does not declare an explicit permissions block, so the auto-generated GITHUB_TOKEN receives default broad permissions including contents:write. The workflow only needs to upload build artifacts and does not push to the repository or create releases. Adding a minimal permissions block would reduce blast radius if any step is compromised.

Impact: low · Exploitability: unlikely

Developer action: Add a top-level permissions block with only the permissions this workflow needs, such as contents: read.

Scanner

zizmor 1.28.0

Rule

excessive-permissions

File role

tooling

Source

.github/workflows/deploy-staging.yml:8-56

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The setup-node action is referenced by major version tag only. A compromise of the action repository could alter behavior for future runs. Pinning to a full commit SHA would eliminate tag-rewrite risk. This is a supply-chain hardening best practice rather than an active vulnerability in the current workflow.

Impact: low · Exploitability: plausible

Developer action: Pin actions to full commit SHAs instead of version tags for supply-chain hardening.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/ci.yml:16

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0097 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2026-0097 against a dependency in this Cargo.lock at medium severity. The affected package name and version are not provided in the scanner evidence, and the Cargo.lock excerpt is truncated. The project is a Tauri desktop RPG with a local attack surface. No evidence shows attacker-controlled input reaching the vulnerable code at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0097

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references dtolnay/rust-toolchain using a floating stable tag rather than a SHA digest. This is a third-party action, so a tag re-pointing or account compromise could inject code into the build pipeline. SHA pinning would eliminate this supply-chain risk.

Impact: low · Exploitability: plausible

Developer action: Pin dtolnay/rust-toolchain to a full commit SHA instead of the stable tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/release.yml:27

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The upload-artifact action is referenced by floating tag v4 rather than a pinned commit SHA. If the action repository were compromised and the tag moved, malicious code would execute in the workflow. The workflow triggers only on push to staging, limiting exposure to maintainers with write access.

Impact: low · Exploitability: plausible

Developer action: Pin actions/upload-artifact to a specific commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/deploy-staging.yml:51

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0009 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2026-0009 against a dependency in this Cargo.lock at medium severity. The affected package identity is not included in the scanner output, and the provided Cargo.lock source is truncated, so the specific crate cannot be confirmed. This is a local Tauri desktop application with no demonstrated runtime path from attacker input to the vulnerable code.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0009

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0429 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2024-0429 against a dependency in this Cargo.lock at medium severity. The affected package name and version are not provided in the scanner evidence, and the Cargo.lock excerpt is truncated. The project is a Tauri desktop RPG application with a local attack surface. No runtime reachability or attacker-input path to the vulnerable code is shown in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0429

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-25h7-pfq9-p65f to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a lockfile dependency. The visible lockfile context shows this project includes numerous dev-only transitive dependencies for build tooling, testing, and CSS processing. The scanner removed package details, so the specific vulnerable package and its classification cannot be confirmed. Without confirming the vulnerable code ships in the production Tauri application and is reachable by attacker-controlled input, the end-user risk remains low for this desktop app.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package and upgrade it. If it is a production dependency, prioritize the upgrade; if dev-only, schedule it as maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-25h7-pfq9-p65f

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0415 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2024-0415 against a dependency in this Cargo.lock at medium severity. The affected package identity is not included in the scanner output, and the provided Cargo.lock source is truncated, preventing confirmation of the specific crate. This is a local Tauri desktop application; no evidence demonstrates attacker-controlled input reaching the vulnerable code at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0415

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The setup-node action is referenced by floating tag v4 rather than a pinned commit SHA. A compromised tag could inject malicious code into the build environment with access to the GITHUB_TOKEN.

Impact: low · Exploitability: plausible

Developer action: Pin actions/setup-node to a specific commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/deploy-staging.yml:14

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0413 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2024-0413 against a dependency in this Cargo.lock at medium severity. The affected package name and version are not provided in the scanner evidence, and the Cargo.lock excerpt is truncated. The project is a Tauri desktop RPG with a local attack surface. No runtime reachability or attacker-input path to the vulnerable code is demonstrated by the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient; consult the advisory details to identify the specific crate.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0413

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references dtolnay/rust-toolchain by a floating tag (stable) rather than a commit SHA. This is a widely used third-party action for Rust toolchain setup. Using a mutable tag means CI could run altered code if the tag is moved. The action is used only for toolchain installation in a CI build job, so practical impact is limited.

Impact: low · Exploitability: unlikely

Developer action: Pin dtolnay/rust-toolchain to a full commit SHA with a version comment for reproducibility and supply-chain hardening.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/ci.yml:39

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a lockfile dependency. The scanner removed package details, preventing identification of the specific vulnerable package, its version, and whether it is a production or dev dependency. The project is a local Tauri desktop application with limited external attack surface. Without confirming runtime reachability of the vulnerable code in the shipped application, the risk remains low.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit to identify the specific package and upgrade if a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

GHSA-4w7w-66w2-5vf9

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0419 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0419 against a dependency in this Tauri desktop app's Cargo.lock. The advisory is medium severity. The supplied source context is a partial Cargo.lock (first ~640 of ~3500+ lines) and the scanner removed package details, so the specific vulnerable crate, its version, and whether its vulnerable code path is reachable at runtime cannot be confirmed from the supplied evidence. This is a desktop application with limited external attack surface; advisory severity alone does not establish concrete exploitable harm.

Impact: low · Exploitability: unlikely

Developer action: Run cargo update or adjust Cargo.toml to pull a fixed version of the flagged dependency. Verify with cargo audit after updating.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0419

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-hmw2-7cc7-3qxx to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a lockfile dependency. The visible lockfile portion shows many transitive dependencies are dev-only build tools. The scanner removed package details, so the specific vulnerable package and its production versus dev classification cannot be confirmed. Without establishing that the vulnerable code is in a production dependency reachable by attacker-controlled input in this desktop application, the end-user risk remains low.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package and upgrade it. Prioritize production dependencies over dev-only ones.

Scanner

osv-scanner 2.4.0

Rule

GHSA-hmw2-7cc7-3qxx

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0370 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0370 against a dependency in this Cargo.lock. The advisory is medium severity. Package details were stripped from the scanner output and the supplied source excerpt does not cover the full lock file, so the affected crate, its pinned version, and runtime reachability of the vulnerable code cannot be determined. As a Tauri desktop application, the attack surface is primarily local; without confirmed attacker-controlled input reaching the vulnerable path, concrete harm is speculative.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version and re-run cargo audit to confirm resolution.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0370

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references actions/setup-node using a floating major-version tag rather than a SHA digest. This is an official GitHub action so tag compromise is unlikely, but SHA pinning is the recommended hardening practice to prevent supply-chain tag-swap attacks.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-node to a full commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/release.yml:21

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a lockfile dependency. The scanner removed package details, preventing confirmation of the specific vulnerable package, its version, and whether it ships in the production application. The project is a Tauri desktop frontend with many dev-only transitive dependencies visible in the lockfile. Without confirming production runtime reachability and an attacker-controlled input path, the end-user risk remains low.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package and upgrade it. Prioritize production dependencies over dev-only ones.

Scanner

osv-scanner 2.4.0

Rule

GHSA-23c5-xmqv-rm74

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched advisory GHSA-3jxr-9vmj-r5cp against a declared dependency in this Tauri desktop frontend project, but package details were removed from the scanner output, preventing definitive identification of the affected package and version. The lockfile root dependencies include @tauri-apps/plugin-shell at ^2.3.3, which is a production dependency with inherent command-execution capability. However, in a Tauri 2.x app, shell plugin invocations are gated by the app's allowlist configuration, and the resolved version 2.3.3 may already be patched. Without confirming the exact package and vulnerable version range, and given that Tauri shell access is a stated capability of this desktop RPG companion (launching the MCP server process), the advisory likely represents a dependency hygiene issue rather than a directly exploitable runtime flaw.

Impact: low · Exploitability: unlikely

Developer action: Update @tauri-apps/plugin-shell and other Tauri plugins to their latest 2.x patch versions and verify the Tauri shell allowlist is scoped to only required commands.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3jxr-9vmj-r5cp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0412 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0412 against a dependency in this Cargo.lock. The advisory is medium severity. The scanner removed package identifiers and the supplied source excerpt is partial, preventing identification of the specific crate, its version, or whether the vulnerable code path is exercised at runtime. The project is a local desktop RPG tool; without evidence of attacker-controlled input reaching the vulnerable function, the practical impact is uncertain and likely limited.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a fixed version and verify with cargo audit.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0412

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0417 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0417 against a dependency in this Cargo.lock. The advisory is medium severity. Package details were removed from the scanner output and the supplied source excerpt does not include the full lock file, so the affected crate, its pinned version, and runtime reachability cannot be confirmed. The application is a Tauri desktop tool with primarily local attack surface; advisory severity alone does not demonstrate exploitable harm.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version and re-run cargo audit.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0417

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-7gcf-g7xr-8hxj to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched GHSA-7gcf-g7xr-8hxj against a dependency in this Cargo.lock. The advisory is medium severity. The scanner stripped package details and the supplied source excerpt is partial, so the specific crate, version, and runtime reachability of vulnerable code cannot be determined. As a desktop application, external attack surface is limited; without confirmed attacker-controlled input reaching the vulnerable path, concrete harm is speculative.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a fixed version and verify with cargo audit.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7gcf-g7xr-8hxj

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-434x-w66g-qw3r to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched GHSA-434x-w66g-qw3r against a dependency in this Cargo.lock. The advisory is medium severity. Package identifiers were removed from the scanner output and the supplied source excerpt does not cover the full lock file, preventing identification of the affected crate, its version, or whether the vulnerable code path is reachable at runtime. The project is a Tauri desktop application; without evidence of attacker-controlled input reaching the vulnerable function, practical impact is uncertain.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version and re-run cargo audit.

Scanner

osv-scanner 2.4.0

Rule

GHSA-434x-w66g-qw3r

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0195 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2026-0195 against a dependency in this Cargo.lock. The advisory identifier carries a 2026 date, which is unusual and may indicate a recently published or pre-dated advisory. The scanner removed package details and the supplied source excerpt is partial, so the affected crate, version, and runtime reachability cannot be confirmed. The advisory is rated medium severity. As a desktop application with limited external attack surface, and without confirmed attacker-controlled input reaching the vulnerable path, concrete harm is speculative.

Impact: low · Exploitability: unlikely

Developer action: Verify the advisory is legitimate via the RustSec database, then update the affected dependency to a patched version if confirmed. Re-run cargo audit.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0195

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0075 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2025-0075 against a dependency in this Cargo.lock. The advisory is medium severity. Package details were stripped from the scanner output and the supplied source excerpt does not include the full lock file, so the specific crate, its pinned version, and whether the vulnerable code path is exercised at runtime cannot be determined. The project is a Tauri desktop RPG tool; without evidence of attacker-controlled input reaching the vulnerable function, practical impact is uncertain and likely limited.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version and re-run cargo audit.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0075

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0057 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2025-0057 against a dependency in this Cargo.lock. The advisory is rated medium severity, but the affected package name and version were removed from scanner output, and the supplied source context does not include the matching package entry. This is a Tauri desktop application for local RPG game management; without identifying the specific crate and confirming runtime reachability of the vulnerable code path, concrete user harm cannot be established. Medium-severity advisories in a desktop app context with no confirmed attacker-controlled input path represent a minor weakness.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit or osv-scanner with full output to identify the affected crate, then update it to a patched version if available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0057

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-7r86-cg39-jmmj was matched by OSV-scanner with package details removed. This advisory identifier is associated with esbuild's development server, which is present as a dev-only dependency at version 0.25.12 in the lockfile. The esbuild dev-server advisory was addressed in versions at or above 0.25.0, so the resolved 0.25.12 likely falls outside the vulnerable range. Even if still matched, esbuild is a build-time tool that does not ship in the Tauri production bundle, so there is no runtime reachability for end users.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full package details to confirm the exact package and version, and update if a vulnerable version is genuinely present.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7r86-cg39-jmmj

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-6g55-p6wh-862q was matched with package details removed. This advisory is commonly associated with Vite, which is declared as a dev dependency at ^7.0.4. Vite is a build-time bundler that does not ship in the Tauri production frontend bundle. The resolved Vite 7.x line is recent and likely outside vulnerable ranges for older Vite advisories. Without confirmed package identification, runtime reachability for end users is not established.

Impact: low · Exploitability: unlikely

Developer action: Confirm the exact matched package via a full audit run and update the affected dev dependency if a vulnerable version is present.

Scanner

osv-scanner 2.4.0

Rule

GHSA-6g55-p6wh-862q

File role

production

Source

package-lock.json

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout action is referenced by major version tag only. Same supply-chain hardening consideration as other unpinned action references in this workflow. No current exploitation path exists; the risk is future tag-rewrite compromise.

Impact: low · Exploitability: plausible

Developer action: Pin actions to full commit SHAs instead of version tags for supply-chain hardening.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/ci.yml:13

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0081 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2025-0081 against a dependency in this Cargo.lock. The advisory is rated medium severity, but the affected package details were stripped from the scanner output and the supplied source context does not contain the matching entry. The project is a local Tauri desktop RPG tool; without confirming which crate is affected and whether attacker-controlled input reaches the vulnerable code, the practical risk is indeterminate but likely low given the desktop deployment model.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0081

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout action is referenced by floating tag v4 rather than a pinned commit SHA. A compromised tag could inject malicious code at the first step of the workflow, affecting all subsequent steps.

Impact: low · Exploitability: plausible

Developer action: Pin actions/checkout to a specific commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/deploy-staging.yml:11

Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-67mh-4wv8-2f99 (medium severity) was matched with package details removed. This advisory is associated with @adobe/css-tools ReDoS, and the lockfile shows @adobe/css-tools at version 4.4.4 marked as dev-only. The known ReDoS fix was in version 4.4.1, so 4.4.4 is likely patched. Additionally, this is a transitive dev dependency of tailwindcss and does not ship in the production bundle.

Impact: low · Exploitability: unlikely

Developer action: Verify with a full audit that the matched version is genuinely vulnerable; if so, update the transitive dependency through a dev dependency refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-67mh-4wv8-2f99

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0221 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2026-0221 against a dependency in this Cargo.lock. The advisory is rated medium severity. Package details were removed from scanner output and the matching entry is not visible in the supplied source context. This is a Tauri desktop game companion; without identifying the affected crate or confirming runtime reachability and attacker input paths, concrete harm cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0221

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-rf6f-7fwh-wjgh to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-rf6f-7fwh-wjgh was matched with package details removed, preventing identification of the affected package and version. The lockfile context visible includes both production and dev dependencies, but without the specific package name it is not possible to confirm runtime reachability or attacker input paths. Given this is a frontend Tauri project where most flagged advisories in similar ecosystems map to build-time tooling, the likely impact is limited to development environments.

Impact: low · Exploitability: unlikely

Developer action: Run a full dependency audit with package names visible to identify the affected package and update it.

Scanner

osv-scanner 2.4.0

Rule

GHSA-rf6f-7fwh-wjgh

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0100 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2025-0100 against a dependency in this Cargo.lock. The advisory is rated medium severity. The affected package name and version were removed from scanner output, and the supplied source context does not include the matching package entry. The project is a local desktop RPG application; without confirming the specific crate, its version, and whether attacker-controlled data reaches the vulnerable code path, the practical impact is indeterminate and likely low.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0100

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-r28c-9q8g-f849 was matched with package details removed. Without the specific package name and version, runtime reachability and attacker control paths cannot be confirmed. The project is a Tauri desktop frontend where the majority of transitive dependencies in the lockfile are dev-only build tooling that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Identify the exact package via a full audit and update if a vulnerable version is confirmed.

Scanner

osv-scanner 2.4.0

Rule

GHSA-r28c-9q8g-f849

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-3v7f-55p6-f55p (medium severity) was matched with package details removed. This advisory may relate to CSS processing tooling such as @adobe/css-tools or lightningcss, both of which appear as dev-only dependencies in the lockfile. Dev-only dependencies in a Tauri project are not bundled into the production app, so end-user runtime reachability is not established.

Impact: low · Exploitability: unlikely

Developer action: Confirm the exact package and version with a full audit and update the affected dev dependency.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3v7f-55p6-f55p

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-mw96-cpmx-2vgc to a dependency declared by this repository.

Contextual assessment: Advisory GHSA-mw96-cpmx-2vgc was matched with package details removed. Without the specific package identification, it is not possible to verify the resolved version, runtime reachability, or whether attacker-controlled input reaches the vulnerable code path. The project's production dependencies are primarily React, Three.js, Tauri plugins, and utility libraries, while the majority of lockfile entries are dev-only build tooling.

Impact: low · Exploitability: unlikely

Developer action: Run a full dependency audit with package names to identify the affected package and update it to a patched version.

Scanner

osv-scanner 2.4.0

Rule

GHSA-mw96-cpmx-2vgc

File role

production

Source

package-lock.json

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references tauri-apps/tauri-action using a floating v0 tag rather than a SHA digest. This is a third-party action that receives the GITHUB_TOKEN, so a tag re-pointing or account compromise could inject code with release-creation privileges. SHA pinning would eliminate this supply-chain risk.

Impact: low · Exploitability: plausible

Developer action: Pin tauri-apps/tauri-action to a full commit SHA instead of the v0 tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/release.yml:55

Scanner reason: OSV-Scanner matched advisory GHSA-w5hq-g745-h8pq to a dependency declared by this repository.

Contextual assessment: GHSA-w5hq-g745-h8pq is a medium-severity ReDoS advisory. The visible lockfile portion shows a CSS parsing utility at version 4.4.4 marked dev-only, transitively pulled by the TailwindCSS build toolchain. In this Tauri desktop application, CSS is processed at build time from project source files, not from user-supplied or network-delivered input. The vulnerable code path has no runtime reachability in the shipped application bundle, and no attacker-controlled input reaches the parser during normal operation.

Impact: low · Exploitability: unlikely

Developer action: Update the affected transitive dependency through a TailwindCSS or PostCSS upgrade when convenient; no urgent action required.

Scanner

osv-scanner 2.4.0

Rule

GHSA-w5hq-g745-h8pq

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.

Contextual assessment: GHSA-f886-m6hf-6m8v is a medium-severity advisory. The specific package could not be confirmed from the visible lockfile portion, but the project's production dependency list consists of well-maintained packages (React, Three.js, Zod, Zustand, Tauri plugins, markdown renderers) with no known match for this advisory at the declared versions. The remaining dependency tree is dominated by dev-only build tooling (Vite, Vitest, TailwindCSS, PostCSS, Babel). In a Tauri desktop app, dev dependencies do not ship in the final bundle and have no runtime reachability for end users.

Impact: low · Exploitability: unlikely

Developer action: Run an audit tool with package names visible to identify and update the specific dependency; no urgent action required for the shipped app.

Scanner

osv-scanner 2.4.0

Rule

GHSA-f886-m6hf-6m8v

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-v2wj-q39q-566r to a dependency declared by this repository.

Contextual assessment: GHSA-v2wj-q39q-566r is a high-severity advisory. The specific package could not be confirmed from the visible lockfile portion. This project is a Tauri desktop frontend with no server surface exposed to remote clients. The production dependencies are standard, actively maintained packages at recent versions. High-severity advisories in frontend build ecosystems commonly affect archive extraction or process-spawning utilities that are dev-only transitive dependencies with no runtime reachability in the shipped bundle. Without a server listener or remote input path, attacker-controlled data does not reach these code paths at runtime.

Impact: low · Exploitability: unlikely

Developer action: Run an audit tool with package names visible to identify the specific dependency and update it; confirm whether it is a dev-only dependency.

Scanner

osv-scanner 2.4.0

Rule

GHSA-v2wj-q39q-566r

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0416 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2024-0416 against a dependency in this Cargo.lock. The advisory is rated medium severity. Package details were stripped from scanner output and the matching entry is not present in the supplied source context. This is a Tauri desktop RPG tool; without identifying the affected crate and confirming runtime reachability of the vulnerable code, concrete user harm cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0416

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.

Contextual assessment: GHSA-qx2v-qp2m-jg93 is a medium-severity advisory. The specific package could not be confirmed from the visible lockfile portion. The project's production dependencies at the declared versions do not match known medium-severity advisories for this ID. The dependency tree is dominated by dev-only build tooling. In a Tauri desktop app, dev dependencies are excluded from the shipped bundle and have no runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Run an audit tool with package names visible to identify and update the specific dependency; no urgent action required.

Scanner

osv-scanner 2.4.0

Rule

GHSA-qx2v-qp2m-jg93

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: GHSA-fxqj-rqcc-2cmp is a medium-severity advisory. The specific package could not be confirmed from the visible lockfile portion. This advisory pattern is consistent with development-server request-forwarding issues in build tooling such as bundlers. In a Tauri desktop app, the development server is only used during local development and is not part of the shipped application. No remote attacker can reach the development server during normal end-user operation.

Impact: low · Exploitability: unlikely

Developer action: Update the affected build tool dependency when convenient; no urgent action required for the shipped app.

Scanner

osv-scanner 2.4.0

Rule

GHSA-fxqj-rqcc-2cmp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-96hv-2xvq-fx4p to a dependency declared by this repository.

Contextual assessment: GHSA-96hv-2xvq-fx4p is a high-severity advisory. The specific package could not be confirmed from the visible lockfile portion. The project is a Tauri desktop frontend with no exposed server surface. The production dependency list at the declared versions does not match known high-severity advisories for this ID. High-severity advisories in this ecosystem commonly affect dev-only transitive dependencies such as archive handling or DOM simulation libraries used in testing. These have no runtime reachability in the shipped bundle, and no attacker-controlled input reaches them during normal operation.

Impact: low · Exploitability: unlikely

Developer action: Run an audit tool with package names visible to identify the specific dependency and update it; confirm whether it is a dev-only dependency.

Scanner

osv-scanner 2.4.0

Rule

GHSA-96hv-2xvq-fx4p

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.

Contextual assessment: GHSA-3ppc-4f35-3m26 is a high-severity advisory. The visible lockfile portion shows a CSS parsing utility at version 4.4.4 marked dev-only, which is consistent with the advisory family for that package. The utility is transitively pulled by the TailwindCSS build toolchain and processes only project source CSS at build time. No user-supplied or network-delivered input reaches this parser. The vulnerable code path has no runtime reachability in the shipped Tauri application bundle.

Impact: low · Exploitability: unlikely

Developer action: Update the affected transitive dependency through a TailwindCSS or PostCSS upgrade when convenient; no urgent action required.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3ppc-4f35-3m26

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: GHSA-mh99-v99m-4gvg is a high-severity advisory. The specific package could not be confirmed from the visible lockfile portion. The project is a Tauri desktop frontend with no server surface. The production dependencies at the declared versions are standard, actively maintained packages. High-severity advisories in frontend dependency trees frequently affect dev-only utilities such as archive extraction, process spawning, or file-system helpers that are excluded from the shipped bundle. Without a remote input path, attacker-controlled data does not reach these code paths at runtime.

Impact: low · Exploitability: unlikely

Developer action: Run an audit tool with package names visible to identify the specific dependency and update it; confirm whether it is a dev-only dependency.

Scanner

osv-scanner 2.4.0

Rule

GHSA-mh99-v99m-4gvg

File role

production

Source

package-lock.json

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The tauri-apps/tauri-action is a third-party action referenced by floating tag v0 rather than a pinned commit SHA. This action receives the GITHUB_TOKEN via environment variable. A compromised tag could exfiltrate the token or inject malicious build artifacts.

Impact: low · Exploitability: plausible

Developer action: Pin tauri-apps/tauri-action to a specific commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/deploy-staging.yml:39

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The test job does not declare an explicit permissions block, so it inherits the repository default token permissions. This job only runs npm ci and npm test with no write operations, so broad permissions are unused. Adding a minimal permissions block would follow least-privilege best practice.

Impact: low · Exploitability: unlikely

Developer action: Add an explicit permissions block with contents: read to the test job to follow least-privilege practice.

Scanner

zizmor 1.28.0

Rule

excessive-permissions

File role

tooling

Source

.github/workflows/ci.yml:10-25

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0194 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2026-0194 against a dependency in this Cargo.lock. The advisory is rated medium severity. The affected package details were removed from scanner output and the matching entry is not visible in the supplied source context. The project is a local Tauri desktop game companion; without confirming the specific crate, its version, and whether attacker-controlled data reaches the vulnerable code, practical impact is indeterminate and likely low.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0194

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-58qx-3vcg-4xpx to a dependency declared by this repository.

Contextual assessment: This advisory likely corresponds to @adobe/css-tools, which appears in the lockfile at version 4.4.4 marked as dev-only. This package is a transitive dependency of CSS processing tooling (tailwindcss/postcss) used at build time. Even if the advisory range includes this version, the vulnerable CSS parsing code has no runtime reachability in the shipped Tauri desktop application. A ReDoS or similar parsing issue would require a malicious CSS input during development builds, which is an unlikely attack vector for a local desktop RPG companion app.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to the latest patched version when convenient; no urgent action required.

Scanner

osv-scanner 2.4.0

Rule

GHSA-58qx-3vcg-4xpx

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-cq8v-f236-94qc to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched GHSA-cq8v-f236-94qc against a dependency in this Cargo.lock. The advisory is rated low severity. Package details were removed from scanner output and the matching entry is not present in the supplied source context. A low-severity advisory in a desktop application dependency, without confirmed runtime reachability or attacker input paths, represents a minor weakness with minimal practical risk.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-cq8v-f236-94qc

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.

Contextual assessment: The scanner flagged a high-severity advisory but removed package details, preventing definitive mapping to a specific dependency in the lockfile. The visible lockfile entries show that the majority of dependencies in this Tauri frontend project are dev-only build tooling (babel, postcss, tailwindcss, esbuild, vite, vitest). This desktop application runs locally without exposing network services, so even if this advisory affects a production dependency, the attack surface for a local RPG companion app is limited. Without confirming the exact package and version, the concrete user harm cannot be established as material.

Impact: low · Exploitability: unlikely

Developer action: Run the scanner with package details enabled to identify the specific dependency, then update it to a patched version.

Scanner

osv-scanner 2.4.0

Rule

GHSA-c2c7-rcm5-vvqj

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0411 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched RUSTSEC-2024-0411 against a dependency in this Cargo.lock. The advisory is rated medium severity. The affected package name and version were removed from scanner output, and the supplied source context does not include the matching package entry. This is a Tauri desktop RPG application; without identifying the specific crate and confirming whether attacker-controlled input reaches the vulnerable code path, concrete user harm cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Run cargo audit with full output to identify the affected crate and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0411

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-r6v5-fh4h-64xc to a dependency declared by this repository.

Contextual assessment: A GitHub-sourced medium-severity advisory matched a dependency declared in this Tauri desktop application's Cargo.lock. The scanner removed package details, so the specific affected crate and its version cannot be confirmed from the supplied evidence. The project is a local desktop RPG companion tool; without identifying the package, its runtime reachability, and whether attacker-controlled input reaches the vulnerable code path, concrete user harm cannot be established. Medium-severity Rust advisories typically address panics, edge-case correctness bugs, or limited-scope issues rather than remote code execution or credential theft.

Impact: low · Exploitability: unlikely

Developer action: Update affected dependencies to patched versions when convenient. Run cargo update or consult the advisory details to identify and upgrade the specific crate.

Scanner

osv-scanner 2.4.0

Rule

GHSA-r6v5-fh4h-64xc

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The workflow has no top-level permissions block, so both jobs inherit repository-default GITHUB_TOKEN permissions. Neither job performs write operations, uploads artifacts, or deploys. The broad permissions are unused but represent a least-privilege gap.

Impact: low · Exploitability: unlikely

Developer action: Add a top-level permissions block with contents: read to follow least-privilege practice.

Scanner

zizmor 1.28.0

Rule

excessive-permissions

File role

tooling

Source

.github/workflows/ci.yml:1-60

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout action in the build-check job is referenced by major version tag only. Same supply-chain hardening consideration as other unpinned references. No current exploitation path; risk is future tag-rewrite compromise.

Impact: low · Exploitability: plausible

Developer action: Pin actions to full commit SHAs instead of version tags for supply-chain hardening.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/ci.yml:30

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0080 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2025-0080) matched a dependency in this Tauri application's Cargo.lock. Package details were stripped from the scanner output, preventing identification of the affected crate and its pinned version. The application is a local desktop RPG tool with no evidence of internet-facing services that would expose the vulnerable code path to untrusted input. Without runtime reachability and attacker-control analysis, the advisory's medium severity does not translate to material user harm in this context.

Impact: low · Exploitability: unlikely

Developer action: Review the RUSTSEC-2025-0080 advisory, identify the affected crate in Cargo.lock, and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0080

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references actions/setup-node by a floating major tag (v4) rather than a commit SHA. This is a common practice but introduces a supply-chain risk: if the action repository tag is moved to a malicious commit, the CI could execute altered code. The action is a well-known first-party GitHub action used only for Node setup in a CI build job, limiting practical impact.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-node to a full commit SHA with a version comment for reproducibility and supply-chain hardening.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/ci.yml:33

Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory was matched but package details were removed. The project is a Tauri desktop frontend with no server-side attack surface. Many dependencies visible in the lockfile are dev-only tooling. Without identifying the specific package and confirming runtime reachability in the shipped application, concrete user harm cannot be established as material. The advisory severity alone does not indicate immediate danger in this context.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific dependency from the scanner output and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

GHSA-48c2-rrv3-qjmp

File role

production

Source

package-lock.json

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The build-check job does not declare an explicit permissions block, inheriting repository defaults. This job only runs npm ci, npm run build, and a Rust toolchain setup with no write or deploy operations. Broad permissions are unused; a minimal permissions block would follow least-privilege best practice.

Impact: low · Exploitability: unlikely

Developer action: Add an explicit permissions block with contents: read to the build-check job to follow least-privilege practice.

Scanner

zizmor 1.28.0

Rule

excessive-permissions

File role

tooling

Source

.github/workflows/ci.yml:27-60

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The dtolnay/rust-toolchain action is a third-party action referenced by floating tag stable rather than a pinned commit SHA. A compromised tag could inject malicious code into the Rust toolchain setup, affecting the build environment.

Impact: low · Exploitability: plausible

Developer action: Pin dtolnay/rust-toolchain to a specific commit SHA instead of a floating tag.

Scanner

zizmor 1.28.0

Rule

unpinned-uses

File role

tooling

Source

.github/workflows/deploy-staging.yml:20

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0007 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2026-0007) matched a dependency in this Cargo.lock. The scanner removed package identifiers, so the affected crate and version cannot be determined from the supplied evidence. This is a Tauri desktop application for local RPG gameplay; there is no indication of a network service exposing the dependency's vulnerable code to external attackers. The advisory's medium severity, without confirmed runtime reachability or attacker-controlled input, does not indicate material risk.

Impact: low · Exploitability: unlikely

Developer action: Look up RUSTSEC-2026-0007, find the affected crate in the lock file, and upgrade to a patched release.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0007

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched but package details were removed, preventing confirmation of which dependency is affected and whether it ships in the production bundle. The project is a local Tauri desktop application with no network-facing services in the frontend. The visible lockfile shows predominantly dev-only build tooling. Without confirming the specific package, version, and runtime reachability, the advisory severity alone cannot establish material user harm in this desktop app context.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific dependency from the scanner output and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

GHSA-rgw5-rvv9-x895

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0418 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2024-0418) matched a dependency in this Tauri desktop application's Cargo.lock. Package details were removed from the scanner output, preventing identification of the specific crate and version. The project is a local desktop RPG companion with no evidence of internet-facing attack surface that would expose the vulnerable code to untrusted input. Without confirming runtime reachability and attacker control, the medium advisory severity does not establish material user harm.

Impact: low · Exploitability: unlikely

Developer action: Consult the RUSTSEC-2024-0418 advisory, identify the affected crate, and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0418

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The checkout action in the build-check job persists the default GITHUB_TOKEN in the local git config. This job performs no subsequent git remote operations and uploads no artifacts, so the persisted credential has no reachable exfiltration path. The token is short-lived and repo-scoped.

Impact: low · Exploitability: unlikely

Developer action: Add persist-credentials: false to the checkout step if no git remote operations are needed in this job.

Scanner

zizmor 1.28.0

Rule

artipacked

File role

tooling

Source

.github/workflows/ci.yml:30

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0414 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2024-0414) matched a dependency in this Cargo.lock. The scanner stripped package details, so the affected crate and its pinned version cannot be identified from the supplied evidence. This Tauri desktop RPG application has no demonstrated network-facing service that would expose the dependency's vulnerable code path to external attackers. Without runtime reachability and attacker-control confirmation, the medium advisory severity does not translate to material risk.

Impact: low · Exploitability: unlikely

Developer action: Review RUSTSEC-2024-0414, locate the affected crate in Cargo.lock, and upgrade to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0414

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0190 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2026-0190) matched a dependency in this Tauri application's Cargo.lock. Package identifiers were removed from the scanner output, preventing confirmation of the affected crate and version. The project is a local desktop RPG companion tool with no evidence of external attack surface exposing the vulnerable code. Without runtime reachability and attacker-control analysis, the medium advisory severity does not establish material user harm.

Impact: low · Exploitability: unlikely

Developer action: Look up RUSTSEC-2026-0190, find the affected crate in the lock file, and upgrade to a patched release.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0190

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0420 to a dependency declared by this repository.

Contextual assessment: A RUSTSEC medium-severity advisory (2024-0420) matched a dependency in this Cargo.lock. The scanner removed package details, so the affected crate and its version cannot be determined from the supplied evidence. This is a Tauri desktop RPG application with no demonstrated internet-facing service that would expose the dependency's vulnerable code to untrusted external input. Without confirming runtime reachability and attacker control, the medium advisory severity does not indicate material risk.

Impact: low · Exploitability: unlikely

Developer action: Consult the RUSTSEC-2024-0420 advisory, identify the affected crate in Cargo.lock, and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0420

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched but package details were removed. The project is a Tauri desktop RPG companion that runs locally. The frontend dependencies visible in the lockfile are typical React/Three.js ecosystem packages, with many transitive dependencies marked as dev-only. Without identifying the specific affected package and confirming it ships in the production bundle with attacker-controlled input reaching the vulnerable code, the concrete harm cannot be established as material for this desktop app context.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific dependency from the scanner output and update to a patched version.

Scanner

osv-scanner 2.4.0

Rule

GHSA-fx2h-pf6j-xcff

File role

production

Source

package-lock.json

All eight OSV-scanner candidates have their package details removed from the scanner output, which prevents confirming which specific package and resolved version each advisory maps to. The visible lockfile portion shows the root project depends on Tauri 2.x plugins, React 19, Three.js, and standard build tooling (Vite, esbuild, Babel, TailwindCSS, PostCSS) as dev dependencies. In a Tauri desktop app, dev dependencies are not bundled into the shipped production frontend, so advisories affecting dev-only packages have no end-user runtime reachability. The production dependencies that carry inherent capability (plugin-shell, plugin-fs) match the stated purpose of a desktop RPG companion that launches an MCP server and persists state. A full audit with package names visible is needed to confirm whether any production dependency is genuinely running a vulnerable version.

Impact: low · Exploitability: unlikely

Developer action: Run osv-scanner or npm audit with full package name output to identify each affected package, then update production dependencies first and dev dependencies second.

Sources:

• package-lock.json:1-46

OSV-scanner removed package names from all eight advisory candidates, and only the first approximately 160 lines of a 300 KB lockfile were supplied as source context. Two candidates could be correlated to a visible dev-only CSS parsing utility at version 4.4.4. The remaining six could not be definitively mapped to specific packages. However, the project is a Tauri desktop frontend with no server surface, the production dependency list consists of well-maintained packages at recent versions, and the dev dependency tree is dominated by build tooling that does not ship in the final bundle. These factors collectively indicate low runtime risk regardless of which specific packages are affected. Running a local audit with package names visible would allow precise identification and targeted updates.

Impact: low · Exploitability: unlikely

Developer action: Run a local dependency audit with package names visible to identify each flagged package, confirm whether each is a dev-only dependency, and update affected packages or their parent packages when convenient.

Sources:

• package-lock.json:47-52