A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The scanner flagged a web address in the code as suspicious. Looking at the actual code, that address is simply the default local address of the user's own Ollama software, used only when the user hasn't configured anything else. Nothing is sent to any outside service; this is the standard, expected way embedding extensions find a local Ollama installation.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal at line 137 is a fallback URL string resolving to the local loopback address on the standard Ollama port. It is the last link in a URL resolution chain: a user-configured alternate endpoint, then SillyTavern's stored Ollama text-generation server URL, then this local default. It is passed as the apiUrl field in the request body to SillyTavern's own vector API endpoints, which mirrors how SillyTavern's core Vector Storage extension resolves embedding backends. No data flows to any remote third-party destination, no credentials are attached to this URL by the extension itself, and the destination is the user's own local machine. The URL is only reached when no user or host configuration exists, and it serves the project's documented embedding purpose.