A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The extension fetches a list of embedding models from the OpenRouter API and displays them in a dropdown. The model names are escaped before display, and no code is executed from the fetched data. This is a standard model-browser feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The preview button fetches an orphaned file and shows its contents as plain text. There is no code execution or HTML injection. This is a normal preview feature for a file-management modal.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged region fetches a client-relative path via fetch(path), reads the body as text, and renders it with jQuery's $panel.text(text). The .text() method sets textContent, which does not parse HTML or execute script. There is no eval, Function constructor, innerHTML assignment of fetched data, or command sink. Template literals constructing $row use escapeHtml() for the path/filename. The .html() calls at lines 41 and 51 use static string literals with no interpolation. The scanner's 'execution sink' correlation does not correspond to any actual dynamic code execution path in the fetched data flow.
Preview uses text() not html() for fetched content
low risk · high confidence
Fetched file content is inserted as plain text, which prevents any embedded markup or scripts from running. This is safe behavior.
Technical assessment
The fetch result is rendered exclusively via $panel.text(text), which assigns to textContent and neutralizes any HTML or script in the response body. No innerHTML, .html(), eval, or similar sink receives the network-retrieved data.