TavernKeeper Scan Report

prolix-oc/Lumiverse-SimTracker

Commit 428e063 Reviewed

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 10 low

What this review found

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Material concern · high confidence

When a tracker template is loaded, any JavaScript hidden inside a special script tag in that template is run automatically. Because templates can be imported from files shared by others, a malicious template could run hidden code in your browser that might steal your API keys or other sensitive data. The documentation does not warn users that imported templates can execute arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The executeTemplateLogic function extracts the body of a script tag with a custom type from the active preset's htmlTemplate field and passes it directly to new Function, executing it with the caller's privileges. Presets are user-importable JSON bundles per the project documentation, and the extracted logic runs without sanitization or disclosure. A malicious preset shared in the community could embed arbitrary JavaScript that executes in the frontend context, gaining access to the DOM, stored credentials, model API keys, and other sensitive session state. The project documentation describes Handlebars templates and helpers but does not disclose that presets can contain arbitrary executable JavaScript, so users importing a preset have no warning of this risk.

Impact: high · Exploitability: plausible

Developer action: Review the cited evidence and confirm the intended behavior.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
src/frontend.ts:1009

Minor cautions

Dependency advisory GHSA-2w6w-674q-4c4q applies

Minor caution · low confidence

This flags a critical known issue in a development-only library. The extension ships ready-to-use files, so people who install it never download these libraries. The versions listed are recent and likely already fixed. Any risk is limited to the developer's own build process, not to people using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2w6w-674q-4c4q to a dependency declared by this repository.

Contextual assessment: The lockfile declares only devDependencies (handlebars, lumiverse-spindle-types, typescript, yaml) and their transitive deps. The project ships pre-built dist files, so end users do not install these packages. The critical advisory cannot be confidently mapped to a specific package because scanner package details were removed, and all listed versions appear recent. Even if a vulnerable package is bundled into dist at build time, the versions present (e.g., handlebars@4.7.8, yaml@2.8.2) are latest or near-latest releases. Runtime reachability for end users is indirect at most, and attacker-controlled input would need to reach the vulnerable code path through LLM-generated tracker data, limiting concrete harm.

Impact: low · Exploitability: unlikely

Developer action: Update all devDependencies to their latest versions during routine maintenance to clear scanner findings.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2w6w-674q-4c4q
File role
production
Source
bun.lock

Dependency advisory GHSA-48c2-rrv3-qjmp applies

Minor caution · low confidence

A medium-severity issue was found in a library used only during development. Since the finished extension is pre-built, users are not exposed to this library directly. The versions are recent and the practical risk is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory matches a devDependency in the lockfile. All workspace dependencies are devDependencies used for building templates and compiling TypeScript. The project ships pre-built dist artifacts, so end-user runtime exposure to these packages is absent unless bundled. The listed versions are recent, and without confirmed package-to-advisory mapping, concrete user harm cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-48c2-rrv3-qjmp
File role
production
Source
bun.lock

Dependency advisory GHSA-2qvq-rjwj-gvw9 applies

Minor caution · low confidence

A medium-level issue was found in a development-only library. People who install the extension get pre-built files and never touch this library. The risk to users is minimal.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2qvq-rjwj-gvw9 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory targets a devDependency. The lockfile contains only devDependencies and their transitive packages. End users receive pre-built dist files and do not resolve these dependencies. The versions present are recent, and no runtime path from untrusted user input to the vulnerable code can be confirmed from the lockfile alone.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2qvq-rjwj-gvw9
File role
production
Source
bun.lock

Dependency advisory GHSA-xhpv-hc6g-r9c6 applies

Minor caution · low confidence

A high-severity issue was flagged in a library used only for building the extension. Users install pre-built files and are not exposed to this library. The versions are recent, so the practical danger is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xhpv-hc6g-r9c6 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a devDependency. All packages in the lockfile are devDependencies or their transitive dependencies. The project ships pre-built dist files, so end users do not install or directly execute these packages. The listed versions are recent releases. Without confirmed mapping to a specific package and version-range check, runtime reachability and concrete user harm cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xhpv-hc6g-r9c6
File role
production
Source
bun.lock

Dependency advisory GHSA-9cx6-37pm-9jff applies

Minor caution · low confidence

A high-severity issue was found in a development-only library. The extension ships ready-to-use files, so users never download this library. The versions are recent and the risk is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-9cx6-37pm-9jff to a dependency declared by this repository.

Contextual assessment: This high-severity advisory targets a devDependency in the lockfile. The workspace declares only devDependencies, and the project distributes pre-built dist artifacts. End users do not resolve these packages. The versions listed are recent, and no confirmed runtime path from attacker-controlled input to vulnerable code is evident from the lockfile.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-9cx6-37pm-9jff
File role
production
Source
bun.lock

Dependency advisory GHSA-7rx3-28cr-v5wh applies

Minor caution · low confidence

A medium-level issue was found in a library used only during development. Users get pre-built files and are not exposed. The risk is minimal.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7rx3-28cr-v5wh to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory matches a devDependency. The lockfile contains only devDependencies and transitive packages used during the build. The project ships pre-built dist files, eliminating direct end-user exposure. The versions present are recent, and no concrete runtime harm can be confirmed from the lockfile alone.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7rx3-28cr-v5wh
File role
production
Source
bun.lock

Dependency advisory GHSA-xjpj-3mr7-gcpf applies

Minor caution · low confidence

A high-severity issue was flagged in a development-only library. The extension ships pre-built files, so users are not exposed to this library. The versions are recent and the practical risk is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xjpj-3mr7-gcpf to a dependency declared by this repository.

Contextual assessment: This high-severity advisory targets a devDependency. All workspace dependencies are devDependencies, and the project distributes pre-built dist files. End users do not install these packages. The listed versions are recent, and without confirmed package mapping, runtime reachability and concrete user harm cannot be established from the lockfile.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xjpj-3mr7-gcpf
File role
production
Source
bun.lock

Dependency advisory GHSA-442j-39wm-28r2 applies

Minor caution · low confidence

A low-severity issue was found in a development-only library. Users install pre-built files and never touch this library. The risk is negligible.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-442j-39wm-28r2 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory matches a devDependency. The lockfile declares only devDependencies and their transitive packages. The project ships pre-built dist artifacts, so end users do not resolve these dependencies. The versions present are recent, and the low advisory severity combined with devDependency status means concrete user harm is negligible.

Impact: low · Exploitability: unlikely

Developer action: Update devDependencies to latest versions during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-442j-39wm-28r2
File role
production
Source
bun.lock
Expected scanner matches (1)

Dependency advisory GHSA-3mfm-83xf-c92r applies

Expected behavior · high confidence

The security warning is about a flaw in an older version of a template-building tool. This project uses the fixed version, and the tool is only used by developers during building, not by people who install the finished extension. The warning does not apply here.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3mfm-83xf-c92r to a dependency declared by this repository.

Contextual assessment: The advisory GHSA-3mfm-83xf-c92r affects handlebars versions prior to 4.7.8. The lockfile resolves handlebars to exactly 4.7.8, which is the patched release. Additionally, handlebars is declared as a devDependency used for template compilation during the build step; the project ships pre-built dist artifacts, so handlebars is not present in the runtime extension package consumed by end users. There is no runtime reachability for the vulnerable code path in the shipped product, and the resolved version is outside the advisory's affected range.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
osv-scanner 2.4.0
Rule
GHSA-3mfm-83xf-c92r
File role
production
Source
bun.lock

Related contextual observations

All lockfile dependencies are devDependencies in a pre-built extension

low risk · low confidence

Every library flagged by the scanner is used only for building the extension, not for running it. People who install the extension get ready-to-use files and never download these libraries. The library versions are recent, so most flagged issues are likely already fixed. The overall risk to users is low.

Technical assessment

The file workspace section declares only devDependencies: handlebars, lumiverse-spindle-types, typescript, and yaml. There are no runtime dependencies. The project README confirms that dist/backend.js and dist/frontend.js are shipped pre-built. End users install the extension and receive these bundled files without running bun install. All eight scanner advisories therefore target build-time tooling. If handlebars or yaml are bundled into the dist files, their versions (4.7.8 and 2.8.2 respectively) are recent releases that likely incorporate fixes for older advisories. The scanner removed package details, preventing confident mapping of each GHSA ID to a specific package and version-range check.

Impact: low · Exploitability: unlikely

Developer action: Periodically update devDependencies and rebuild dist files to keep scanner findings clear and ensure any bundled library versions incorporate the latest security fixes.

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity