TavernKeeper Scan Report

senjinthedragon/SillyTavern-Discord-Connector

Commit e3a2678 Reviewed

5 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 5 material 16 low

What this review found

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Material concern · medium confidence

A library used by this Discord connector has a known high-level security flaw. Because the connector receives messages from Discord and runs a server, it is possible that a malicious message or request could crash or freeze the bridge. This would interrupt your chat but is unlikely to expose your bot token or other secrets.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched against a dependency in the lockfile. This project is a network-facing Discord bridge server that accepts untrusted Discord messages and exposes HTTP or WebSocket endpoints, giving potential attacker-controlled input a path to vulnerable parsing or connection-handling code in transitive dependencies. High-severity advisories in this category commonly describe ReDoS, header-based DoS, or request-smuggling flaws that can crash or hang a Node.js server. Because the bridge server runs on the user's own machine and handles a Discord bot token, a crash or hang disrupts service but is unlikely to expose credentials. Runtime reachability depends on whether the vulnerable code path processes external input, which is plausible given the server's architecture but cannot be confirmed from the truncated lockfile alone.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Run an audit to identify which transitive dependency is involved and whether a direct dependency bump resolves it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3jxr-9vmj-r5cp
File role
production
Source
package-lock.json

Dependency advisory GHSA-52cp-r559-cp3m applies

Material concern · medium confidence

Another library used by this Discord connector has a known high-level security issue. A crafted message or request could potentially crash or freeze the bridge server, interrupting your roleplay session. Your bot token and other secrets are unlikely to be exposed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched against a dependency in the lockfile for this network-facing bridge server. The extension accepts untrusted Discord messages and likely uses HTTP routing or WebSocket libraries whose transitive dependencies may contain ReDoS or DoS flaws. Attacker-controlled input from Discord messages or HTTP requests could plausibly reach the vulnerable code path. The concrete harm is most likely service disruption (server hang or crash) rather than credential theft or remote code execution, given the typical nature of these advisories and the local single-user deployment model.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Identify the transitive dependency chain and bump the direct dependency that resolves the advisory.

Scanner
osv-scanner 2.4.0
Rule
GHSA-52cp-r559-cp3m
File role
production
Source
package-lock.json

Dependency advisory GHSA-vxpw-j846-p89q applies

Material concern · medium confidence

A scanner found a serious issue in a library this extension uses for web requests. If a server the extension talks to were to redirect the extension to a different website, sensitive information like API keys could accidentally be sent to that other site. This is unlikely to happen in normal use because the extension talks to servers the operator has set up, but it is worth fixing.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-vxpw-j846-p89q to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. This is most likely the undici cross-origin redirect issue where sensitive headers such as Authorization can be forwarded to a different origin on redirect. The bridge does make authenticated HTTP requests (e.g., to image-generation APIs or SillyTavern), so the vulnerable code path is reachable. However, exploitation requires a compromised or malicious endpoint that issues a cross-origin redirect, which is unlikely when endpoints are user-configured and trusted. Concrete harm would be leakage of API credentials or auth tokens to an unintended destination.

Impact: medium · Exploitability: unlikely

Developer action: Update the affected HTTP client dependency to a version that patches this advisory. Run npm audit for the exact package and version range.

Scanner
osv-scanner 2.4.0
Rule
GHSA-vxpw-j846-p89q
File role
production
Source
server/package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Material concern · medium confidence

A library used by this Discord connector has a known high-level security flaw. It may be possible for a malicious message or network request to crash or slow down the bridge server. The main risk is interrupted service, not stolen credentials.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched against a dependency in the lockfile. The bridge server processes untrusted network input and likely depends on packages for HTTP requests, WebSocket connections, or file handling whose vulnerable code may be reachable at runtime. If the affected package is only used during installation or build steps, runtime reachability would be low; however, for a server that handles Discord gateway traffic and SillyTavern API calls, network-facing code paths are likely involved. The expected impact is DoS or service disruption rather than credential exfiltration.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Verify whether the vulnerable code path is exercised at runtime; if it is build-time only, the risk is lower but updating is still recommended.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Material concern · medium confidence

A library used by this Discord connector has a known high-level security issue. Someone sending a specially crafted message or request could potentially crash or freeze the bridge. This would stop your Discord chat from working but should not expose your bot token.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: A high-severity advisory was matched against a dependency in the lockfile. This Discord bridge server accepts untrusted messages and makes outbound API calls, so transitive dependencies handling HTTP, WebSocket, or URL parsing may receive attacker-influenced input. The advisory likely describes a DoS, ReDoS, or request-handling flaw that could crash or hang the server. Concrete user harm is service disruption of the bridge, not credential exposure or code execution, given the local deployment model and typical advisory characteristics in this category.

Impact: medium · Exploitability: plausible

Developer action: Update the affected dependency to a patched version. Run a dependency audit to trace the advisory to its direct dependency and apply the appropriate version bump.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json

Minor cautions

Dependency advisory GHSA-m8rv-5g2x-5cg5 applies

Minor caution · medium confidence

A security scanner found a known issue in one of the libraries this extension uses. The issue is in a component that handles web requests, but in this extension the web addresses are set by the person running the server, not by people chatting on Discord, so it would be hard for an attacker to exploit.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency declared in this lockfile. The project's direct dependencies include an HTTP client (undici ^6.24.0) that is the most likely subject of this advisory. The bridge uses this client to make requests to user-configured endpoints (local SillyTavern API, image-generation services). Request URLs and headers are set by the server administrator, not by Discord message content, so attacker control over the vulnerable input surface is limited. Without the full lockfile the exact resolved version cannot be confirmed, but the direct dependency range is recent.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m8rv-5g2x-5cg5
File role
production
Source
server/package-lock.json

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version label instead of a fixed code hash for a standard GitHub build tool. This is a common shortcut and very unlikely to cause problems, but locking to a specific hash is safer.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The second actions/setup-node@v4 reference uses a major-version floating tag rather than a SHA pin. This is an official GitHub action, and the workflow runs only on release publication with scoped permissions, so tag-repointing risk is minimal. Pinning to a commit SHA is best practice but not a material vulnerability here.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-node to a full commit SHA for reproducibility and supply-chain hardening.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/publish.yml:30

zizmor reported cache-poisoning

Minor caution · medium confidence

A scanner flagged a possible cache-tampering concern, but this workflow does not turn on caching or save build outputs, so the practical risk is very low.

Technical evidence

Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.

Contextual assessment: zizmor flags potential cache poisoning around the second setup-node step. The workflow does not explicitly enable dependency caching in setup-node, does not upload build artifacts, and runs only on release publication. There is no observable path for a poisoned cache to alter the published package without other compromise.

Impact: low · Exploitability: unlikely

Developer action: No change required; if caching is added later, scope cache keys to branch and lockfile hashes.

Scanner
zizmor 1.28.0
Rule
cache-poisoning
File role
tooling
Source
.github/workflows/publish.yml:30

zizmor reported artipacked

Minor caution · medium confidence

The checkout step leaves a temporary token in the local git folder by default. Since nothing in this workflow saves or shares that folder, the token cannot leak, but turning off that default is a good habit.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The artipacked rule fires because actions/checkout defaults to persist-credentials true, leaving the GITHUB_TOKEN in the local git config. This workflow never uploads artifacts or shares the workspace, so there is no exfiltration path. Setting persist-credentials false is a low-cost hardening step.

Impact: low · Exploitability: unlikely

Developer action: Set persist-credentials: false on the checkout step unless git push is needed.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/publish.yml:14-15

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version label instead of a fixed code hash for the standard checkout tool. This is common and low-risk, but a fixed hash is safer.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: actions/checkout@v4 uses a floating major-version tag instead of a SHA pin. This is an official GitHub action in a release-triggered workflow with read-scoped contents permission. Tag-repointing risk exists in theory but is minimal for first-party actions.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA for supply-chain hardening.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/publish.yml:15

Dependency advisory GHSA-h67p-54hq-rp68 applies

Minor caution · medium confidence

A library used by this Discord connector has a known medium-level security issue. The most likely effect is that the bridge server could temporarily stop working if someone sends specially crafted data, but it is unlikely to lead to stolen tokens or other serious harm.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory was matched against a dependency declared in the lockfile for this Discord bridge server extension. The project processes untrusted network input (Discord messages) and exposes network endpoints, but medium-severity advisories in this ecosystem typically describe limited DoS or edge-case handling flaws. Without the specific package identity and version visible in the truncated lockfile, the concrete harm is most likely temporary service interruption of a hobbyist bridge server rather than credential exposure or code execution. The advisory severity alone does not establish immediate danger.

Impact: low · Exploitability: plausible

Developer action: Update the affected dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-h67p-54hq-rp68
File role
production
Source
package-lock.json

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version label instead of a fixed code hash for a standard GitHub build tool. This is a common shortcut and very unlikely to cause problems, but locking to a specific hash is safer.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The first actions/setup-node@v4 reference uses a floating major-version tag rather than a SHA pin. Same assessment as the other unpinned-uses candidates: official action, release-only trigger, scoped permissions, minimal practical risk.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-node to a full commit SHA for reproducibility and supply-chain hardening.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/publish.yml:18

Dependency advisory GHSA-p88m-4jfj-68fv applies

Minor caution · medium confidence

A scanner found a medium-level issue in a library used by this extension. Because the extension only talks to servers the operator has configured, it is unlikely someone could use this issue to cause harm.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-p88m-4jfj-68fv to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. Based on the direct dependencies visible (undici ^6.24.0, ws ^8.18.0), this most likely targets the HTTP client library. The bridge makes outbound requests to administrator-configured endpoints; Discord users do not control the destination URLs or request headers. Runtime reachability of the vulnerable code path depends on whether proxy or redirect features are exercised, which is unlikely in a typical localhost-to-SillyTavern deployment.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-p88m-4jfj-68fv
File role
production
Source
server/package-lock.json

Dependency advisory GHSA-35p6-xmwp-9g52 applies

Minor caution · medium confidence

A scanner found a minor issue in a library used by this extension. The issue involves an edge case that is unlikely to matter for how this extension is normally used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-35p6-xmwp-9g52 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. The project's direct dependencies suggest this targets the HTTP client library. Low-severity advisories in this category typically involve edge-case handling of proxy authentication or request formatting. The bridge does not appear to use proxy configurations in its standard deployment, and request destinations are administrator-controlled, limiting both reachability and attacker input control.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-35p6-xmwp-9g52
File role
production
Source
server/package-lock.json

Dependency advisory GHSA-8xcm-r25x-g524 applies

Minor caution · medium confidence

A scanner found a known issue in a library this extension uses. Because the extension sends web requests to servers chosen by the operator rather than to addresses controlled by Discord users, the issue is hard to exploit in practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. Based on the visible direct dependencies, this most likely concerns the HTTP client library's handling of request formatting or redirect logic. The bridge sends requests to user-configured endpoints with headers set by the server administrator. Discord message content is routed to the AI model, not to HTTP request parameters, so attacker control over the vulnerable input is limited.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8xcm-r25x-g524
File role
production
Source
server/package-lock.json

Dependency advisory GHSA-g8m3-5g58-fq7m applies

Minor caution · medium confidence

A scanner found a small issue in a library this extension uses. It is unlikely to cause problems in normal use of the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-g8m3-5g58-fq7m to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. The advisory likely targets the HTTP client library used for outbound requests. Low-severity issues in this category generally involve narrow edge cases with limited real-world impact. The bridge's request destinations and headers are administrator-configured, and no proxy usage is evident in the standard setup, reducing both reachability and exploitability.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-g8m3-5g58-fq7m
File role
production
Source
server/package-lock.json

zizmor reported cache-poisoning

Minor caution · medium confidence

A scanner flagged a possible cache-tampering concern, but this workflow does not turn on caching or save build outputs, so the practical risk is very low.

Technical evidence

Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.

Contextual assessment: zizmor flags potential cache poisoning around the first setup-node step. The workflow does not explicitly enable caching, does not upload artifacts, and triggers only on release publication. No concrete cache-poisoning-to-published-package path is observable.

Impact: low · Exploitability: unlikely

Developer action: No change required; if caching is added later, scope cache keys to branch and lockfile hashes.

Scanner
zizmor 1.28.0
Rule
cache-poisoning
File role
tooling
Source
.github/workflows/publish.yml:18

Dependency advisory GHSA-v3r7-h72x-cjcm applies

Minor caution · medium confidence

A scanner found a known issue in a library this extension uses for web requests. Since the extension only contacts servers set up by the operator, it is unlikely that someone chatting on Discord could exploit this issue.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. The direct dependencies indicate this most likely concerns the HTTP client library. The bridge makes requests to administrator-configured endpoints, and Discord users do not control the request URLs, headers, or proxy settings. Runtime reachability of the specific vulnerable code path depends on conditions that are not met in a standard deployment.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v3r7-h72x-cjcm
File role
production
Source
server/package-lock.json
Expected scanner matches (2)

Gitleaks reported discord-client-id

Expected behavior · high confidence

This is a fake example number left in a sample settings file to show users what the format looks like. It is not a real password or secret, and the line is commented out so it has no effect.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule discord-client-id in this repository.

Contextual assessment: The scanner matched a Discord identifier pattern on a line inside a commented-out example block within a template file named config.example.js. The value is a placeholder used to illustrate the conversationLinks configuration structure. A Discord channel ID is not a secret credential, and the value is not live or user-supplied. No real credential is exposed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
discord-client-id
File role
production
Source
server/config.example.js:156

Gitleaks reported discord-client-id

Expected behavior · high confidence

This is a fake, placeholder ID left in an example settings file to show users what format to use. It is not a real credential and is not active code.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule discord-client-id in this repository.

Contextual assessment: The flagged value is a placeholder Discord channel ID inside a commented-out example block in a file explicitly named config.example.js. The value is a sequential placeholder, not a real credential, and the surrounding lines are all commented out. This is a standard example-configuration pattern with no live data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
discord-client-id
File role
production
Source
server/config.example.js:165

Related contextual observations

Placeholder IDs in commented example configuration

low risk · high confidence

The example file shows fake IDs in comments so users know what to fill in. Nothing here is real or active.

Technical assessment

The conversationLinks array contains only commented-out example entries with placeholder channel and chat IDs. These serve as documentation for users and are not executed or read at runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity