What this review found
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Material concern · high confidence
When a tracker template is loaded, any JavaScript hidden inside a special script tag in that template is run automatically. Because templates can be imported from files shared by others, a malicious template could run hidden code in your browser that might steal your API keys or other sensitive data. The documentation does not warn users that imported templates can execute arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The executeTemplateLogic function extracts the body of a script tag with a custom type from the active preset's htmlTemplate field and passes it directly to new Function, executing it with the caller's privileges. Presets are user-importable JSON bundles per the project documentation, and the extracted logic runs without sanitization or disclosure. A malicious preset shared in the community could embed arbitrary JavaScript that executes in the frontend context, gaining access to the DOM, stored credentials, model API keys, and other sensitive session state. The project documentation describes Handlebars templates and helpers but does not disclose that presets can contain arbitrary executable JavaScript, so users importing a preset have no warning of this risk.
Impact: high · Exploitability: plausible
Developer action: Review the cited evidence and confirm the intended behavior.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- src/frontend.ts:1009
Minor cautions
Dependency advisory GHSA-2w6w-674q-4c4q applies
Minor caution · low confidence
This flags a critical known issue in a development-only library. The extension ships ready-to-use files, so people who install it never download these libraries. The versions listed are recent and likely already fixed. Any risk is limited to the developer's own build process, not to people using the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2w6w-674q-4c4q to a dependency declared by this repository.
Contextual assessment: The lockfile declares only devDependencies (handlebars, lumiverse-spindle-types, typescript, yaml) and their transitive deps. The project ships pre-built dist files, so end users do not install these packages. The critical advisory cannot be confidently mapped to a specific package because scanner package details were removed, and all listed versions appear recent. Even if a vulnerable package is bundled into dist at build time, the versions present (e.g., handlebars@4.7.8, yaml@2.8.2) are latest or near-latest releases. Runtime reachability for end users is indirect at most, and attacker-controlled input would need to reach the vulnerable code path through LLM-generated tracker data, limiting concrete harm.
Impact: low · Exploitability: unlikely
Developer action: Update all devDependencies to their latest versions during routine maintenance to clear scanner findings.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2w6w-674q-4c4q
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-48c2-rrv3-qjmp applies
Minor caution · low confidence
A medium-severity issue was found in a library used only during development. Since the finished extension is pre-built, users are not exposed to this library directly. The versions are recent and the practical risk is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a devDependency in the lockfile. All workspace dependencies are devDependencies used for building templates and compiling TypeScript. The project ships pre-built dist artifacts, so end-user runtime exposure to these packages is absent unless bundled. The listed versions are recent, and without confirmed package-to-advisory mapping, concrete user harm cannot be established.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-48c2-rrv3-qjmp
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-2qvq-rjwj-gvw9 applies
Minor caution · low confidence
A medium-level issue was found in a development-only library. People who install the extension get pre-built files and never touch this library. The risk to users is minimal.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2qvq-rjwj-gvw9 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory targets a devDependency. The lockfile contains only devDependencies and their transitive packages. End users receive pre-built dist files and do not resolve these dependencies. The versions present are recent, and no runtime path from untrusted user input to the vulnerable code can be confirmed from the lockfile alone.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2qvq-rjwj-gvw9
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-xhpv-hc6g-r9c6 applies
Minor caution · low confidence
A high-severity issue was flagged in a library used only for building the extension. Users install pre-built files and are not exposed to this library. The versions are recent, so the practical danger is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xhpv-hc6g-r9c6 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory matches a devDependency. All packages in the lockfile are devDependencies or their transitive dependencies. The project ships pre-built dist files, so end users do not install or directly execute these packages. The listed versions are recent releases. Without confirmed mapping to a specific package and version-range check, runtime reachability and concrete user harm cannot be established.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xhpv-hc6g-r9c6
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-9cx6-37pm-9jff applies
Minor caution · low confidence
A high-severity issue was found in a development-only library. The extension ships ready-to-use files, so users never download this library. The versions are recent and the risk is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-9cx6-37pm-9jff to a dependency declared by this repository.
Contextual assessment: This high-severity advisory targets a devDependency in the lockfile. The workspace declares only devDependencies, and the project distributes pre-built dist artifacts. End users do not resolve these packages. The versions listed are recent, and no confirmed runtime path from attacker-controlled input to vulnerable code is evident from the lockfile.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-9cx6-37pm-9jff
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-7rx3-28cr-v5wh applies
Minor caution · low confidence
A medium-level issue was found in a library used only during development. Users get pre-built files and are not exposed. The risk is minimal.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7rx3-28cr-v5wh to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a devDependency. The lockfile contains only devDependencies and transitive packages used during the build. The project ships pre-built dist files, eliminating direct end-user exposure. The versions present are recent, and no concrete runtime harm can be confirmed from the lockfile alone.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7rx3-28cr-v5wh
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-xjpj-3mr7-gcpf applies
Minor caution · low confidence
A high-severity issue was flagged in a development-only library. The extension ships pre-built files, so users are not exposed to this library. The versions are recent and the practical risk is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xjpj-3mr7-gcpf to a dependency declared by this repository.
Contextual assessment: This high-severity advisory targets a devDependency. All workspace dependencies are devDependencies, and the project distributes pre-built dist files. End users do not install these packages. The listed versions are recent, and without confirmed package mapping, runtime reachability and concrete user harm cannot be established from the lockfile.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xjpj-3mr7-gcpf
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-442j-39wm-28r2 applies
Minor caution · low confidence
A low-severity issue was found in a development-only library. Users install pre-built files and never touch this library. The risk is negligible.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-442j-39wm-28r2 to a dependency declared by this repository.
Contextual assessment: This low-severity advisory matches a devDependency. The lockfile declares only devDependencies and their transitive packages. The project ships pre-built dist artifacts, so end users do not resolve these dependencies. The versions present are recent, and the low advisory severity combined with devDependency status means concrete user harm is negligible.
Impact: low · Exploitability: unlikely
Developer action: Update devDependencies to latest versions during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-442j-39wm-28r2
- File role
- production
- Source
- bun.lock
Expected scanner matches (1)
Dependency advisory GHSA-3mfm-83xf-c92r applies
Expected behavior · high confidence
The security warning is about a flaw in an older version of a template-building tool. This project uses the fixed version, and the tool is only used by developers during building, not by people who install the finished extension. The warning does not apply here.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3mfm-83xf-c92r to a dependency declared by this repository.
Contextual assessment: The advisory GHSA-3mfm-83xf-c92r affects handlebars versions prior to 4.7.8. The lockfile resolves handlebars to exactly 4.7.8, which is the patched release. Additionally, handlebars is declared as a devDependency used for template compilation during the build step; the project ships pre-built dist artifacts, so handlebars is not present in the runtime extension package consumed by end users. There is no runtime reachability for the vulnerable code path in the shipped product, and the resolved version is outside the advisory's affected range.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3mfm-83xf-c92r
- File role
- production
- Source
- bun.lock