No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material2 low
What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · medium confidence
This flagged dependency is part of the tools used to build the extension, not part of what actually runs when users install and use it. The security issue does not affect people using the extension, but the developer should still update the build tool when convenient.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: The advisory corresponds to a build-time tooling dependency used for bundling the extension. The shipped extension loads a prebuilt bundle rather than running the vulnerable development server in end-user environments. The vulnerable code path is not reachable during normal SillyTavern extension use. The remaining concern is dependency hygiene for developers who run the build tooling locally.
Impact: none · Exploitability: unlikely
Developer action: Update the affected build-time dependency to a fixed version in the lockfile and rebuild.
This is another build-tool dependency issue. It does not affect users who install and run the extension, but keeping the development tools updated is good practice.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: The advisory matches a development/build dependency rather than a runtime dependency of the shipped extension. The vulnerable functionality is associated with local development tooling and is not executed when SillyTavern loads the built extension. No attacker-controlled input reaches the vulnerable code in the production extension context.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a fixed version when convenient.