TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

Alphonsos88k/ste_summary_editor

Commit ca952cf Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 80 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

The scanner found a 'risky text pattern' warning in a small bundled helper library the extension uses to show before/after comparisons of AI-edited text. The warning is about a theoretical possibility that the page could slow down on certain specially crafted text. The evidence does not show the extension sending data anywhere, stealing anything, or doing anything harmful. The most that could happen from this warning is a temporary freeze or slowness that goes away after a reload.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The static signal targets regular expressions inside a bundled, minified text-diff library (jsdiff) that underpins the extension's advertised side-by-side diff view for AI edits and patch operations. The patterns at this location are whitespace trimming and sentence/word tokenization logic that are a normal part of the diffing algorithm; they are not obfuscated or concealed behavior. JS-X-Ray's unsafe-regex heuristic flags patterns that can exhibit catastrophic backtracking, but the supplied evidence shows no concrete ReDoS trigger, no remote or hidden input path, and no data leaving the browser. Input reaches these functions only through user-selected summary files or AI-generated text the user chooses to process. The worst realistic consequence is temporary UI sluggishness or a frozen tab that is recoverable by reload and is low impact. No malicious data flow, network destination, credential handling, or persistence is identified in the evidence.

Impact: low · Exploitability: unlikely

Developer action: Consider replacing the vendored diff build with an up-to-date maintained release of the diff library and capping the length of inputs passed into diffing routines. This is a hardening suggestion; the evidence does not demonstrate an active vulnerability.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
lib/diff.min.js:37

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

The warning points to a text-parsing step inside the same diff helper library, specifically the part that reads patch-style text before comparing versions of AI-suggested edits. In theory, unusual text could make this step work harder and briefly freeze the page. The code only runs when you load files or apply AI suggestions yourself, and nothing in the evidence suggests data is sent anywhere or that the project hides anything. Any freeze would be temporary and fixable by reloading the page.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged construct is inside the unified-patch parsing routine of the same bundled diff library, used when parsing or applying diffs generated from AI-suggested edits. The flagged pattern is a header-matching expression containing a repeated grouped segment followed by a lazy trailing capture, a shape static analysis associates with potential regex backtracking. Parser input originates only from user-chosen files or AI output the user explicitly applies through the extension UI, so there is no demonstrated remote or hidden attacker-controlled trigger. The evidence does not establish that crafted input reliably stalls this routine, and a static signal alone is not demonstrated exposure. A worst-case slowdown would be a recoverable self-denial-of-service in the browser tab, which is low impact per the community threat model. Nothing in the code, file role, or data flow indicates exfiltration, credential access, persistence, or concealment.

Impact: low · Exploitability: unlikely

Developer action: Validate or limit the size of patch and diff inputs, for example by capping input length before parse and apply operations, and consider swapping the bundled library for a current maintained release. These are hardening measures; no demonstrated vulnerability is shown by the evidence.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
lib/diff.min.js:719

JavaScript analysis reported javascript.xray.unsafe-stmt

Minor caution · medium confidence

This is a built-in feature of the node-graph library where a number box lets you type a math expression and it gets calculated. The check on what may be typed is a bit loose, so in theory something extra could be added after a normal-looking number, but only a person actually typing into that box could trigger it. Nothing in this extension shows an outside file or message controlling what gets evaluated.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-stmt. The match applies to this repository.

Contextual assessment: The flagged signal is in a minified vendored copy of the LiteGraph library, inside the numeric-widget interaction handler. On a number widget's mouse-up event the library opens a value prompt and evaluates what the user typed using eval() to support calculator-style expressions. The validation regex only requires the input to begin with permitted arithmetic characters in its first alternative and does not anchor the end of the string, so a value starting with valid characters but continuing with arbitrary code could pass the check. The trigger is fully user-initiated: the user must type or paste the expression and confirm the prompt. No evidence shows untrusted data such as chat-file content or imported graphs flowing into this evaluated input in the extension's stated use of the library as a node canvas. The capability is inherent to the upstream library and is visible to the user as an ordinary value prompt.

Impact: low · Exploitability: unlikely

Developer action: Replace the eval-based expression evaluation with a dedicated arithmetic parser, or at minimum reject any input that contains characters outside the intended numeric/operator set. If eval must remain for compatibility, harden the validation so the entire input is constrained by both start and end anchors.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-stmt
File role
generated
Source
lib/litegraph.min.js:252
Deterministic technical evidence (35)

  • Dependency advisory GHSA-jfc7-64v2-mr8c:pkg:48258381500edddc1b4f830f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:18

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:14

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:23

  • Dependency advisory GHSA-vmf3-w455-68vh:pkg:8839403d7ee1503124efc2dc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-jxxr-4gwj-5jf2:pkg:5a16524862b548516ef3d6bc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-w8wr-v893-vjvp:pkg:e4415af6a0ab9ff85d724617 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:6567e5dee65459862e18aa65 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-r292-9mhp-454m:pkg:3dc3fc50bb1c79a0dda8c32d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-h67p-54hq-rp68:pkg:0199d54d4e55594b20539f39 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-v2v4-37r5-5v8g:pkg:48552aea5f6fbd6eddc439a5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:a2732cf17ea59b7c9ad7dcba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-8x88-c5mf-7j5w:pkg:476d58f42741a064d387095b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-gvwx-54wh-qm9j:pkg:a043b69b5e3b5e7d7aa4fb57 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:10-20

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:46

  • Dependency advisory GHSA-52v5-jr5w-gjxr:pkg:15611af2164af7d2a94f436e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:2de43aee472c63fa622df5d4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:15

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-52cp-r559-cp3m:pkg:cf5cb3ae8e56cb4261cd5e98 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:27

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:3ece283851d32041a2b1d5e7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:298011774205bdc17d15af3f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:c9664722fa713f708c7e3644 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:22-51

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:6159a1838ee53aace6ac3052 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:1-51

  • Dependency advisory GHSA-mwp4-54f8-5fhr:pkg:83681c3315a11b148347d647 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-23hp-3jrh-7fpw:pkg:2c64070531aec62932e9989b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:6048cd74325f555ae1952584 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:43d548f6bdae1e3984dbe669 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

Contextual expected matches (39)

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

This security warning flagged code that sets up JavaScript inheritance, which is normal for many libraries. The flagged lines are part of Fuse.js, a popular fuzzy-search tool included as a dependency. There is no sign of malicious intent or exploitable vulnerability.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The JS-X-Ray prototype-pollution signal flags `__proto__` assignments at lines 118 and 124. These assignments appear inside standard ES5/ES6 class inheritance polyfills (`s` and `u` functions) generated by Babel or TypeScript compilation for the Fuse.js v7.0.0 library. The `__proto__` access is used strictly for prototype chain setup, not for arbitrary property injection. There is no attacker-controlled input reaching these paths, and the code is a widely used, unmodified third-party library. The signal is a static false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.prototype-pollution
File role
generated
Source
lib/fuse.min.js:118

zizmor reported artipacked

Expected behavior · high confidence

The project's automatic build process packages the extension into a ZIP file and saves it temporarily. It deliberately leaves out sensitive files like passwords and API keys. This is a normal and safe practice for distributing software.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The GitHub Actions workflow creates a ZIP archive of the extension source code (excluding .git, node_modules, .github, key.pat, and other sensitive items) and uploads it as a build artifact with 14-day retention. This is a standard CI/CD practice for distributing extension builds. The explicit exclude list demonstrates awareness of sensitive file handling. No credentials, secrets, or private data are included in the artifact. The zizmor artipacked rule flags potential credential persistence through artifacts, but the evidence shows no actual credential exposure or inclusion.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:27

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A security scanner thought the code might be obfuscated (hard to read on purpose), but looking at the actual code it is written in a normal, readable way. The signal is a false alarm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The JS-X-Ray static analysis flagged obfuscated code, but the supplied source code shows standard JavaScript with clear variable names, JSDoc comments, and no obfuscation patterns such as encoded strings, minified expressions, or dynamic property access that would hide intent. The signal appears to be a false positive from the scanner matching general patterns on normal code like template literals or color hex values.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/integration/chat-files-editor.js:1

JavaScript analysis reported javascript.xray.unsafe-import

Expected behavior · high confidence

This is a compressed version of a common browser storage helper that saves data locally on the user's device. The scanner warning reflects its normal internal packaging, and there is no evidence of data being sent to outside servers.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-import. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-import
File role
generated
Source
lib/localforage.min.js:7

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a minified color-wheel library used in the extension for picking colors. The flagged text is just a standard technical label for SVG elements, not a website link and not code that sends your data anywhere. The scanner saw strings that look like web addresses, but those strings are only used as XML tag namespaces.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged strings are standard XML namespace identifiers used as arguments to DOM attribute namespace operations in a minified vendored color picker library. These are constant values passed into namespace-aware attribute manipulation, not network endpoints, and the shown code contains no data-exfiltration path such as outbound requests or credential handling. Repeated occurrences of the same signal correspond to the same namespace handling logic in the generated file. No attacker-controlled input flows to a remote destination in the supplied evidence, and the behavior matches the library's documented SVG color-picker role. Confidence is high that this is a scanner false positive rather than malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
lib/iro.min.js:335

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is part of a visual programming tool that lets users write small scripts. It has safeguards like a character limit and blocked words.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: LiteGraph's built-in 'Script' node uses new Function() to compile user code up to 256 characters, with a blocklist for dangerous keywords, and only operates when allow_scripts is enabled. This is a documented feature of the visual scripting library.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:10624

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This is the bundled color-picker library. The flagged code only builds an icon URL inside the page when needed, and there is no sign it sends your data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The supplied file is the minified build of iro.js, a recognized third-party color-picker library that the project's stated purpose explicitly uses for arc color selection. The shady-link signal corresponds to the handle-rendering logic that resolves an optional developer-supplied SVG handle URL, and on Safari builds a local absolute URL from the current page location to compensate for base elements. This constructs a URL from local, developer-provided data; the evidence does not show transmission of host state or any unexpected destination. No exfiltration or harmful data flow is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
lib/iro.min.js:7

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is the bundled graph editor's 'Canvas2D' node, which lets the user paste their own drawing code and runs it only when the library's scripts option is turned on. The evidence shows only this intended user-controlled behavior, not any hidden or network activity.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The matched code is the standard Canvas2D texture node of the vendored minified LiteGraph library. It compiles the node's user-authored code widget into a function with the Function constructor only when LiteGraph's allow_scripts flag is enabled, wraps parsing in try/catch, and reports errors visibly rather than concealing them. The executed source is user-entered node code from the editor UI, matching the node's stated purpose of executing canvas drawing code. The supplied evidence shows no data exfiltration, external destination, credential handling, obfuscation, or attacker-controlled input path; execution requires the user to enable scripts and supply the code themselves.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:690

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This is a standard third-party graph-editor library bundled with the extension. It has features that can load files from a URL, and other features that let developers create graph nodes from functions, but there is no evidence those features are chained together to download and run code. The extension's node canvas feature explains why the library is present.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The evidence is a minified vendor copy of the LiteGraph node-editor library, which is a generated file with no associated business logic of its own. The scanner rule fires because the same library source contains both a network file-fetch helper and dynamic code-construction helpers used to wrap JavaScript functions as graph nodes. These capabilities are standard and expected for a node-canvas library, and the supplied evidence does not show any data flow that connects fetched content to a code-execution sink: the fetch helper returns text, JSON, arraybuffer, or blob payloads to callbacks, while the dynamic code construction is an independent developer-facing utility for registering node classes. The extension's advertised node-canvas chat-file analysis feature explains the presence of LiteGraph. No attacker-controlled input path, concealed execution, or exfiltration destination is demonstrated, so the scanner correlation does not establish a security exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
generated
Source
lib/litegraph.min.js:1-40

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

This flagged line is a normal way that compiled JavaScript sets up inheritance between parts of the color picker library. It is not the kind of prototype pollution that lets outside data change shared code behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The flagged pattern is `t.__proto__ = n;` in a transpiled class-inheritance helper that sets a subclass constructor's prototype chain to its parent constructor (standard ES5-style inheritance emitted by Babel/TypeScript for classes in the bundled iro.js library). The same pattern appears for internal component classes. It assigns a fixed, code-derived parent constructor reference, not attacker-controlled input, and does not merge user-supplied keys into Object.prototype or any global prototype. No sink, untrusted data flow, or prototype pollution primitive is demonstrated. The file is a generated third-party color picker library (iro.js) used for the README-described arc color swatch UI.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.prototype-pollution
File role
generated
Source
lib/iro.min.js:1354

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension bundles a standard node-editor library. When you type a number expression into one of its boxes, it uses a calculator-style evaluation that only accepts digits and math symbols, so it cannot run outside code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The matched eval call is part of LiteGraph's number-widget editing flow. When a user edits a numeric node widget, the entered text is first filtered by a regular expression that only permits digits, arithmetic operators, parentheses, and whitespace, or a plain decimal number. This effectively turns eval into an arithmetic expression evaluator; letters, keywords, and function calls are excluded, so no code-injection path is evident. The input is local user interaction with the node canvas, and the supplied evidence does not show untrusted data reaching this path. This is consistent with the expected behavior of the bundled LiteGraph library rather than a security concern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:252

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This alert noticed that the extension loads a script and later uses it to create interactive nodes. But the script is just a built-in library for drawing the node canvas, and it's loaded from the extension's own files — not from somewhere dangerous. This is a normal part of how the feature works.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner observed a network retrieval (loading LiteGraph.js library via _loadScript from a local path) and a code execution sink (LiteGraph's dynamic node execution). However, the script is loaded from a hardcoded local path within the extension's lib directory, not from an external or attacker-controlled URL. The LiteGraph library is a dependency used for node canvas rendering and its internal dynamic code execution is legitimate. There is no evidence of external script injection, eval of untrusted data, or malicious behavior. The scanner pattern is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
src/integration/chat-files-analyser.js:240-707

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner warned that the extension might download and run harmful code. However, it only fetches file lists and chat content from the user's own installed SillyTavern server, and displays them safely. It never downloads or executes scripts from the internet.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated fetch calls to '/api/characters/chats' and '/getchat' with a potential code execution sink in lines 184-341. The supplied source shows these fetches retrieve chat file metadata and content from SillyTavern's own API. No eval, Function, or innerHTML with untreated content is used; all data is handled via escHtml or assigned to textContent/value. The code execution sink is not present—the scanner appears to have overmatched on general presence of fetch and DOM manipulation patterns.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
src/integration/chat-files-manager.js:184-341

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension loads charting and styling libraries from well-known internet servers to add visual features like diagrams. The URLs are fixed and cannot be changed by an attacker, so this is normal and safe.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The extension dynamically creates script elements to load Mermaid.js and Tailwind CSS from hardcoded, reputable CDN URLs. No user-controllable or attack-influenced data is used in constructing these URLs, and no additional dynamic code execution sinks (eval, innerHTML with script content, or Function constructor) are present in the supplied code. This pattern is standard for loading third-party libraries and is proportionate to the extension's stated features (timeline diagram, location bubbles, UI styling).

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:408-2110

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This warning flagged a regular expression inside Fuse.js, a popular fuzzy-search library. The regex is used to split search terms by spaces while keeping quoted phrases intact. It's not known to be dangerous in practice, and there is no evidence it can be exploited in this extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The unsafe-regex signal flags the regex `/ +(?=(?:[^\"]*\"[^\"]*\")*[^\"]*$)/` at line 1246 of Fuse.js v7.0.0. This regex is used in the extended search parser to split the query string on spaces while respecting double-quoted substrings. While the regex contains nested quantifiers, in practice it operates on user-supplied search strings of bounded length and is part of a widely deployed, well-tested library. There is no demonstrated ReDoS vulnerability in this usage context, and no evidence of attacker-controlled input that could cause catastrophic backtracking. The static signal does not represent a real-world exploitability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
lib/fuse.min.js:1246

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

This is a bundled copy of a well-known fuzzy-search helper. The flagged patterns are normal parts of that helper rather than hidden dangerous code, and there is no evidence they can be abused from outside.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The supplied file is the minified build of Fuse.js v7.0.0, a recognized third-party fuzzy-search library that the project's stated purpose explicitly uses for optional fuzzy search. The unsafe-regex signal corresponds to fixed literal regexes used by the library to parse search patterns and quoted phrases. These regexes are static library definitions rather than values constructed from untrusted input, and the evidence does not show a data flow in which attacker-controlled regular expressions reach execution. Any worst-case performance effect would be a local, user-initiated UI slowdown, which does not meet the threshold for material harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
lib/fuse.min.js:9

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is another standard feature of the bundled graph library that lets a user write JavaScript for audio processing. It only runs code the user puts into a node, and the evidence does not show any outside party can trigger it or receive data from it.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The flagged line is in the same bundled LiteGraph library, within the audio/script node. That node is a standard LiteGraph extension that compiles user-authored JavaScript to process audio buffers in the Web Audio graph. The snippet being compiled comes from the node's own code property, which a graph author edits directly. No evidence in the supplied context shows an external attacker controlling this property, the library being loaded with attacker-supplied graph definitions, or any network or storage destination receiving data from this execution path. The behavior is proportional to the library's intended node-based editor functionality and is visibly part of the bundled dependency rather than concealed logic. Therefore it is expected behavior with no demonstrated security exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:900

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This code creates new functions on the fly to wrap user-defined functions as graph nodes. It's a normal part of how the LiteGraph library works and is not a security risk because it only uses data from the function itself, not from outside sources.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Line 828 of the minified LiteGraph library contains 'd = Function(z);' which is a dynamic function constructor used internally in wrapFunctionAsNode to create node wrappers from a function's own parameter list. This is a standard LiteGraph feature for node registration and does not process untrusted user input. The input string 'z' is built from the function's parameter names and types, not from external data. No attacker-controlled input reaches this sink.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:828

JavaScript analysis reported javascript.xray.unsafe-stmt

Expected behavior · high confidence

This allows users to type simple math expressions into number fields, like '2+2', to get a computed result. It is limited so it cannot run arbitrary code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-stmt. The match applies to this repository.

Contextual assessment: LiteGraph number widget uses eval() with a restrictive regex that only allows digits, basic arithmetic operators, and whitespace. This is known safe behavior for expression input and is part of the library's normal operation.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-stmt
File role
generated
Source
lib/litegraph.min.js:6524

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · medium confidence

The flagged lines are just the library copying settings around, which is normal. There is no evidence this lets anyone tamper with the app's internals.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The prototype-pollution signal matches the shallow object-merge helper patterns in the minified Fuse.js bundle that combine default, user, and internal options. These assignment patterns are typical of this library's generated code. The supplied evidence does not demonstrate any execution path where untrusted data is merged onto Object.prototype or a related prototype chain within this extension, and no concrete trigger or attacker-controlled input is identified.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.prototype-pollution
File role
generated
Source
lib/fuse.min.js:9

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The scanner found a place where the node-graph library automatically builds a small function from settings a developer provides. That is a normal library feature, and nothing in this extension shows that data from chat files or outside sources can be fed into it.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The dynamic-execution signal is the Function constructor used inside LiteGraph's wrapFunctionAsNode helper, which builds an onExecute wrapper by concatenating the wrapped function's own reflected parameter names and configured slot types into a new function body. The generated source originates from developer-supplied node definitions, not from user or chat-file content. This extension's stated use of the library is a local node canvas for chat-file analysis, and no evidence shows attacker-controlled strings reaching the Function constructor. The library also ships with script execution disabled by default. This is normal bundled third-party code consistent with the library's documented API rather than concealed or malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:34

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a normal code-evaluation feature inside a bundled visual graph library. It can run JavaScript that a user writes into a graph node, but the evidence does not show that an outside attacker can trigger it or that it sends data anywhere.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The flagged line is inside a bundled, minified copy of the LiteGraph node-graph library. It belongs to the standard geoeval node, whose purpose is to let a graph author supply a small JavaScript snippet that is compiled and executed against geometry data. This is a documented capability of LiteGraph and is consistent with the file being a generated third-party dependency. The supplied evidence shows no data flow from remote or attacker-controlled input into this eval path, no concealed invocation by the extension, and no destination that exfiltrates data. Reaching this code requires constructing or loading a graph containing the eval node and running it locally in the user's browser, where the user already controls the page context. The presence of dynamic execution alone is not a demonstrated vulnerability.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:778

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged network activity comes from the bundled graph-editor library loading images, audio files, and graph data. That is ordinary behavior for this kind of tool, and nothing in the evidence shows it sending user data anywhere it should not.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner produced a static 'shady-link' signal without retaining the matched literal values, so the signal alone does not identify a destination. Reviewing the surrounding source shows the network-related calls in this minified LiteGraph bundle are resource-loading operations consistent with the library's purpose: loading an image for a node, fetching files for graph data, and loading audio samples over HTTP when audio nodes are used. These operations respond to the user's graph configuration and node properties rather than to a hidden hardcoded destination, and there is no evidence of credential handling, data exfiltration, or disclosure to an unexpected party. The file is generated/minified because it is a bundled upstream library, not because of concealment. No demonstrated exposure exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
lib/litegraph.min.js:133

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This allows the user to type a math formula like 'x+y' and get a computed result. It only works if scripting is enabled.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: LiteGraph's 'Formula' node uses new Function() to evaluate a user-provided mathematical expression, guarded by the allow_scripts flag. It is a standard feature for runtime formula evaluation.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:12808

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension includes a graph editor library that lets advanced users write custom canvas code. This is a built-in feature of that library, not a backdoor. The code only runs if the user explicitly enables scripting, and there's no evidence of abuse.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This is a standard LiteGraph Canvas2D node that uses `new Function` to compile user-provided canvas code. The code compiles only when the graph allows scripts (`O.allow_scripts`). This is a core feature of LiteGraph's scripting nodes and not anomalous in the graph editor context. The extension leverages LiteGraph for its UI; no attacker-controlled injection path is demonstrated in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:17438

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line sets a background image for the graph canvas using a small image encoded directly in the code. It's like pasting a picture into a document instead of linking to a file. It's safe and used only for decoration.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Line 3682 assigns a data:image/png;base64 string to DEFAULT_BACKGROUND_IMAGE. This is a hardcoded inline PNG image used as the canvas background texture in LiteGraph's LGraphCanvas. The base64 string decodes to a valid small checkerboard pattern image. There is no network request, external URL, or untrusted data flow. The 'shady-link' signal is a false positive triggered by the presence of a data URI literal, which is legitimate and visible in the source.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
lib/litegraph.min.js:3682

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This alert suggested the extension downloads and runs code. The code actually just asks SillyTavern's own AI service to generate story categories, and it treats the reply as plain text data, not as something to run.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The flagged download-to-execution correlation is not supported by the actual data flow in this region. The code makes a single network call to the host application's chat-completion backend using standard request headers, which matches the extension's documented AI-generation feature for the Story Index panel. The response is parsed as JSON and reduced to plain string data; no dynamic code evaluation, dynamic import, or similar execution construct is applied to the network response. Panel markup is built from locally defined templates and HTML-escaping helpers for entity-derived values, and the AI response is treated strictly as data rather than as executable content. The network capability is proportionate to the stated purpose of generating story index categories, and nothing in the supplied evidence shows downloaded content being executed.

Impact: none · Exploitability: unlikely

Developer action: No change is needed for the flagged download-to-execution concern. The network response is treated as data and never executed as code. A separate, minor rendering note is captured in the observation.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
src/table/entity-sidebar.js:118-375

zizmor reported artipacked

Expected behavior · high confidence

The code-linting step simply downloads the project's source code to check for style errors. No sensitive information is involved or saved.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The lint job uses actions/checkout@v4 to fetch the repository source, followed by standard linting steps. The checkout action itself does not introduce credentials into artifacts. The subsequent build job (separate assessment) handles artifact creation and uploads. There is no exposure of credentials or sensitive data in this step.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:14

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · medium confidence

This is normal internal copying of color and setting data by the color-picker library. No evidence shows it can be used to break into the app.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The prototype-pollution signal matches merge-and-assign helper patterns in the minified iro.js build, which embeds a small UI framework for managing props, state, and color objects. These patterns are standard for the library's generated code. The supplied evidence does not identify any attacker-controlled input that reaches these assignments in a way that pollutes Object.prototype, and no concrete activation path or runtime trigger is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.prototype-pollution
File role
generated
Source
lib/iro.min.js:7

JavaScript analysis reported javascript.xray.unsafe-import

Expected behavior · high confidence

This file is a standard browser storage helper library that keeps data on the user's own device. The scanner warning comes from its internal module setup, which is normal for bundled libraries, and there is no evidence it sends data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-import. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-import
File role
generated
Source
lib/localforage.min.js:24

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This file can both download files and run code from strings, but the two features are in separate parts of the library and are not connected. Downloading is used only for audio files, and code-from-string is used only for internal node creation. There is no way for an attacker to exploit this combination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The minified file contains both an XMLHttpRequest for loading audio files (in loadSound) and a Function constructor (in wrapFunctionAsNode), but these are independent features with no data flow between them. The network retrieval is for audio sources used in the audio node system, and the code execution sink is for node type registration. No evidence connects the two; the correlation is coincidental due to the library's comprehensive feature set.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
generated
Source
lib/litegraph.min.js:6-1036

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

Allows simple math in number fields, safe due to input restrictions.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Same eval() in LiteGraph number widget with restrictive regex. This is a standard feature for inline calculation.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:6524

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

A scanner flagged that the extension downloads data and might run it as code. But the code only fetches chat files from the user's own SillyTavern server and displays them safely—it never runs any downloaded content as a program. This is normal expected behavior for a chat editor.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated a fetch to '/getchat' (a legitimate SillyTavern API endpoint) with potential code execution, but the supplied source code shows no eval, Function constructor, or innerHTML injection of executable content. The fetched JSON data is used only to populate the editor state and is rendered through escHtml-escaped template strings or plain textarea value assignment. No dynamic code execution sink is present in the marked lines 67-136 or anywhere in the file.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
src/integration/chat-files-editor.js:67-136

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · medium confidence

The extension includes a common node-editor library whose Script node lets a user write short JavaScript snippets. That is a visible, intentional feature, and the supplied evidence does not show it being used secretly or with data from untrusted sources.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The matched dynamic-function construction is the Script node implementation inside the bundled LiteGraph library. It creates a function from user-provided script text, but only when the LiteGraph allow_scripts flag is enabled, and it also enforces a maximum length and rejects several sensitive keywords before compiling. The Script node is an explicit, user-visible node type; users intentionally add it to a graph and supply the code. The supplied evidence does not demonstrate that this extension enables allow_scripts, that untrusted graph data reaches this path, or that any exfiltration, persistence, or concealed execution occurs. While the capability is powerful, it matches the declared functionality of the node editor.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:401

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a normal feature of the bundled graph editor library: a 'formula' node that computes math expressions typed by the user. It only runs when the library's scripts option is enabled, and it only executes code that the user themselves entered, so there is no hidden or remotely controlled behavior shown here.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The matched code is the standard math/formula node of the vendored, minified LiteGraph third-party library. It compiles the node's user-editable formula property with the Function constructor only when LiteGraph's allow_scripts flag is enabled, and both compilation and execution are wrapped in try/catch. The evaluated string originates from node configuration the user authors in the editor UI, which is the library's intended scripting capability and consistent with the extension's documented chat-file node canvas feature. No network destination, credential access, obfuscation, persistence, or attacker-controlled trigger is present in the supplied evidence; arbitrary code would require the user to enable scripts and paste hostile code into their own graph, which is self-inflicted rather than a demonstrated exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:492

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension includes a graph editor library with a node that lets users write custom audio processing scripts. This is a normal part of the library and only runs code the user explicitly provides.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This is a standard LiteGraph audio script node that uses `new Function` to compile user-provided audio processing code. The code is provided via a property and executed when the graph runs. This is a core feature of LiteGraph's audio nodes. No attacker-controlled input path is demonstrated; the user must intentionally supply the code.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:22682

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension uses a graph editor library that includes a node for running custom geometry scripts. This is a normal part of that library's functionality and only executes code explicitly provided by the user.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This is a standard LiteGraph geometry evaluation node (geoeval) that uses `new Function` to compile user-provided geometry manipulation code. The code is provided via a property and executed on demand. This is a core feature of LiteGraph's geometry nodes. No attacker-controlled input path is demonstrated; the user must intentionally supply the code.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role
generated
Source
lib/litegraph.min.js:19752

JavaScript analysis reported javascript.xray.short-identifiers

Expected behavior · high confidence

The code uses short variable names because it has been compressed to make it smaller and faster to load. This is standard practice for released JavaScript libraries and is not a sign of hidden malicious code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.short-identifiers. The match applies to this repository.

Contextual assessment: The file is a minified JavaScript library (LiteGraph). Short variable names are a normal result of minification and are not indicative of obfuscation. The code is structurally identical to the original source after renaming. No concealed or intentionally obfuscated behavior is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.short-identifiers
File role
generated
Source
lib/litegraph.min.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This alert was about a fetch request near code that could potentially run new code. But the fetch is just uploading a file to the server, and there is no dangerous code execution happening. It's a normal operation for the extension's purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner flagged a correlation between a network request (line 186: fetch to '/api/files/upload') and a code execution sink, but the provided code does not contain any dynamic code execution like eval, Function, or innerHTML assignment with untrusted input. The fetch is a same-origin POST to SillyTavern's file upload API, used to inject exported summaries as character attachments. This is a standard client-server interaction with no actual code execution risk. The scanner pattern is a false positive due to proximity of fetch to other code, not a real vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
src/export/databank.js:136-186

Related contextual observations

Eval in numeric widget is user-initiated but weakly validated

low risk · medium confidence

The number-box calculator feature can technically run more than math if someone pastes a carefully crafted string, but it still requires that person to type the string themselves.

Technical assessment

The eval() appears in the library's processNodeWidgets number-widget path, where an expression is evaluated after the user edits the widget value. The pre-input validation is incomplete because it does not constrain the entire string, which is a code-quality and hardening issue even though the only demonstrated actor supplying the input is the user typing into the prompt.

Impact: low · Exploitability: unlikely

Developer action: Tighten input validation or use a safe math parser so the feature can only calculate arithmetic expressions.

Sources:

Function constructor is upstream wrapper-generation helper

low risk · high confidence

A node-graph library feature creates new functions from settings the developer writes when building the extension. There is no sign that outside data can slip into it.

Technical assessment

The Function constructor in the minified library is part of LiteGraph's public wrapFunctionAsNode feature, which generates a node wrapper from developer-defined function metadata. The generated code string is assembled from type and parameter-name information controlled by the application developer, not from untrusted runtime input. No call path in the supplied evidence connects this helper to chat-file data, user input, or external content.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Unescaped AI-generated section titles rendered into panel markup

low risk · medium confidence

The panel inserts the AI-generated category headings into the page exactly as the AI wrote them. If the AI ever returned text containing webpage code, the page could interpret it, although nothing indicates that is happening and the AI is the one you already chose to use.

Technical assessment

Model-generated section titles are stored as plain strings and later inserted into the panel's markup without the same HTML escaping that is applied to entity item names elsewhere in the same view. Response parsing only checks that each title is a string and performs no sanitization, so a model reply containing markup could inject HTML into the extension panel when the Story Index is rendered. The supplied evidence shows no demonstrated attacker-controlled path to such a reply: the content originates from the user-configured model provider, is obtained only after an explicit Generate action, and the surrounding data flow does not show a hostile input reaching this rendering path in practice. The issue is a defensive hardening gap rather than a demonstrated vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Apply the same HTML escaping used for entity names to the AI-generated section titles before inserting them into the panel markup.

Sources:

Coverage and limitations

Inventory
156 files · 2075462 bytes
Contextual coverage
77 of 77 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
51 files · 1331608 bytes
X-Ray review families
45 warning occurrences compacted to 18 evidence-preserving review families
Representations
51 raw · 25 decoded · 7 normalized · 0 bundle modules
Stage scans
51 raw signatures · 50 raw AST · 51 raw OpenGrep · 32 derived signatures · 9 derived AST · 32 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
ca952cff8d36cabb95037a4c91c66831ad52b4e4
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
35 fresh / 0 reused groups · 42 fresh / 0 reused candidates
Review source reports
none
Evidence triage
35 deterministic / 42 contextual candidates · 35 contextual / 41 total behavior cases
Model budget
24 model calls · 35 / 12 fresh cases · 1176210 / 200000 estimated input · 1123241 / 250000 actual input · 69673 / 40000 output tokens
Review batching
24 model calls · up to 3 groups and 4 candidates per call · 7 retry calls · 0 over-budget singleton calls
Review usage
1123241 input · 69673 output · 20736 cache read · 0 reasoning tokens
Report
f6c825b533834dcba5879d67ee14dbcf8bcb2de4d10c47831d1aa11e183e6f13