A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The extension lets users upload a cover image for a playlist. It sends the image to SillyTavern's own local image-upload API and then displays the resulting image path in the playlist card. Before showing the path in the page, the code escapes it to prevent any malicious content from running. There is no mechanism here for downloaded content to execute as code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a fetch call with a dynamic DOM sink in the same file. The fetch posts a user-selected cover image (base64-encoded) to the local SillyTavern /api/images/upload endpoint with standard request headers, which is the intended image-upload mechanism for this extension. The response .path is stored in local state and later rendered into innerHTML via _plEsc(), which escapes the value before insertion into an img src attribute. Other innerHTML usages build UI from static template literals and escape dynamic track names, paths, and sources with _plEsc. No eval, Function constructor, string-based setTimeout, or script injection path is present. The data flowing from the network response into the DOM sink is escaped, and the source is a same-origin local API. This is a standard, proportionate pattern for a SillyTavern extension that manages playlist cover images.