A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The code is plain, readable UI rendering logic with no obfuscation. It decodes base64 reasoning text from AI models and displays it in collapsible UI blocks. The scanner flag is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged 'obfuscated-code' with low confidence, but the supplied source is fully readable, well-commented JavaScript that generates HTML for reasoning thought blocks in the SillyTavern UI. The code includes base64 decoding via atob() for Gemini/OpenRouter encoded reasoning — a legitimate feature explicitly documented in comments. Regular expressions are used for input validation, not obfuscation. There is no eval, no dynamic code construction, no encoded strings, and no concealed behavior. The function builds HTML template literals and delegates to SillyTavern's messageFormatting API, which is standard extension behavior.
The code is straightforward, readable form-building logic with no obfuscation. It creates dropdown menus and checkboxes for the extension's settings page. The scanner flag is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged 'obfuscated-code' with low confidence on a file that is entirely clear, well-structured JavaScript rendering pipeline task editor UI. The code builds HTML for dropdown selects, checkboxes, and text areas using template literals — standard DOM manipulation for a SillyTavern extension settings panel. There is no eval, no dynamic code execution, no encoded strings, no minified or packed code, and no concealed logic. Functions are documented with JSDoc comments. The scanner likely triggered on the dense template literal HTML generation patterns.
Unescaped HTML interpolation of model-generated content
low risk · medium confidence
The code inserts AI model output text directly into HTML without escaping. This is common in SillyTavern extensions and the content comes from the user's own model, but properly escaping would be more robust.
Technical assessment
The function interpolates t.title, t.content (or contentHtml), formatLabel, t.profile, and err.message directly into HTML template literals without escaping. In the SillyTavern extension context this is typical — content originates from the user's own model generations and is rendered locally. However, unescaped interpolation could cause rendering issues if model output contains HTML-like content. This does not constitute a demonstrated security exposure since the data source is the user's own model output in a single-user local context.
Impact: low · Exploitability: unlikely
Developer action: Consider HTML-escaping t.title, t.content, and err.message before interpolating them into template literals to prevent potential rendering issues with special characters in model output.