This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 high2 material1 low
What this review found
Function-constructor fallback executes untrusted model output
material risk · medium confidence
The last-resort repair step treats AI text as runnable code. A malicious or manipulated AI response could execute code in the user's session.
Technical assessment
The fallback constructs a function from the cleaned AI output string and immediately invokes it. The only guard is the allowFunctionEval boolean; there is no content validation or sandboxing before execution. Because the input originates from model generations, prompt injection or malformed output can reach this path and execute arbitrary JavaScript in the extension context.
Impact: high · Exploitability: plausible
Developer action: Replace this fallback with a non-executing JSON repair approach, or remove it entirely and fail safely when JSON.parse cannot recover the data.
As a fallback when normal JSON parsing fails, this code runs the AI's text as JavaScript. If the AI is tricked into producing malicious text, that text could run as code inside the user's SillyTavern session.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The Function constructor is used as a last-resort JSON repair path on AI-generated text. Although it is gated behind an allowFunctionEval flag and only reached after JSON.parse fails, the evaluated string is model output that is not guaranteed to be inert. A crafted or prompt-injected model response could contain arbitrary JavaScript that executes in the extension's browser context when this fallback runs, yielding code execution with access to the SillyTavern frontend, extension APIs, and any credentials present there.
Impact: high · Exploitability: plausible
Developer action: Remove the Function-constructor fallback. Use a safe JSON repair library or return null on parse failure. If dynamic evaluation must remain, restrict it to a sandboxed parser and never execute raw model output.
The extension lets users set up their own external AI API to generate tracker data. It stores the API key securely and sends it only to the web address the user themselves entered in settings, as a standard login token. This is exactly how API calls normally work and is not sending your key anywhere you did not configure.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: The flagged data flow retrieves an API key from secure storage and sends it as a Bearer token in an Authorization header to a fetch endpoint. The destination URL is constructed entirely from user-configured extension settings (externalApiSettings.baseUrl), normalized and appended with the standard OpenAI-compatible path. The request body contains standard chat-completion parameters. The API key is only included when present and non-empty, and is sent exclusively to the endpoint the user themselves configured. This is a conventional pattern for calling an external OpenAI-compatible API and matches the function's documented purpose of generating tracker data via an external API. There is no hardcoded or hidden destination, no exfiltration to a third party, and no obfuscation.