RebootFlume/TipsyTavern

Scanner reason: OSV-Scanner matched advisory GHSA-wrw7-89jp-8q8g to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-wrw7-89jp-8q8g against a dependency version present in the Cargo.lock with medium severity. The lockfile is for a Tauri desktop application that makes outbound HTTPS requests to LLM provider APIs. Without the specific package identity and advisory detail, runtime reachability and attacker-controlled input paths cannot be confirmed. Medium-severity advisories in this ecosystem typically involve edge-case panics, build-time concerns, or limited-impact issues rather than directly exploitable runtime flaws in a desktop client context.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that is no longer flagged by this advisory.

Scanner

osv-scanner 2.4.0

Rule

GHSA-wrw7-89jp-8q8g

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0098 to a dependency declared by this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0098

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0429 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0429 against a dependency version in the Cargo.lock with medium severity. The lockfile belongs to a Tauri desktop application. The specific package identity was not included in the scanner output, preventing confirmation of whether the vulnerable code path is reachable at runtime or whether attacker-controlled input can reach it. Medium severity in the Rust ecosystem typically indicates a limited-impact issue such as a panic under specific conditions or an unmaintained crate warning.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0429

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0415 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0415 against a dependency in the Cargo.lock with medium severity. The project is a Tauri desktop AI chat client that makes outbound HTTPS requests to LLM APIs. Without the specific package name and advisory details, it is not possible to confirm runtime reachability of the vulnerable code or whether attacker-controlled input reaches it. Medium-severity Rust advisories commonly involve conditions that are difficult to exploit in a desktop client context.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0415

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0413 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0413 against a dependency version in the Cargo.lock with medium severity. The lockfile is for a Tauri desktop application. The scanner did not include the specific package identity, so runtime reachability and attacker input control cannot be verified. For a desktop client that makes outbound API calls, medium-severity dependency advisories typically represent limited practical risk.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0413

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0419 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0419 against a dependency in the Cargo.lock with medium severity. The project is a Tauri desktop AI chat client. Without the specific package name and full advisory text, it is not possible to determine whether the vulnerable code path is reachable at runtime or whether attacker-controlled input can trigger it. Medium-severity advisories in the Rust ecosystem generally indicate limited-impact issues for desktop applications.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0419

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0370 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0370 against a dependency version in the Cargo.lock with medium severity. The lockfile belongs to a Tauri desktop application. The specific package identity was not provided in the scanner output, preventing verification of runtime reachability or attacker input control. Medium-severity Rust advisories from this period commonly involve build-time concerns, unmaintained crates, or edge-case panics with limited practical impact in a desktop client.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0370

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0412 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory RUSTSEC-2024-0412 against a dependency in the Cargo.lock with medium severity. The project is a Tauri desktop AI chat client that makes outbound HTTPS requests to LLM provider APIs. Without the specific package name and advisory details, runtime reachability of the vulnerable code and attacker-controlled input paths cannot be confirmed. Medium-severity advisories in this context typically represent limited practical risk for a desktop application.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a version that resolves this advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0412

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0417 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a dependency declared in Cargo.lock. The scanner confirms the vulnerable version is present. However, the specific package name and advisory details were stripped from the scanner output, and the supplied source context is a truncated prefix of a large lockfile, so runtime reachability and attacker-controlled input paths cannot be confirmed. This is a Tauri desktop application, not a network-facing server, which limits exposure to many dependency vulnerabilities. Without evidence that vulnerable code is reachable through attacker-controlled input, the advisory represents a maintenance weakness rather than a confirmed exploitable defect.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a version that resolves the advisory when a patched release is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0417

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0195 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a dependency declared in Cargo.lock with high scanner confidence on the version match. The specific package and advisory details were removed from the scanner output, and the truncated lockfile source prevents identifying the exact dependency or tracing runtime reachability. The project is a desktop application with limited network attack surface. Without confirmation that attacker-controlled input reaches the vulnerable code, this is a dependency hygiene issue rather than a confirmed exploitable vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a patched version when available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0195

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0075 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a Cargo.lock dependency. Scanner confidence is high for the version match, but package details were stripped and the supplied source is a truncated prefix of the full lockfile, preventing identification of the specific crate or assessment of runtime reachability. The application is a Tauri desktop client, reducing exposure to network-driven exploitation of many dependency-level issues. No evidence shows attacker-controlled input reaching the vulnerable code path.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a version that resolves the advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0075

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0081 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a declared Cargo.lock dependency with high version-match confidence. The specific package identity and advisory details were removed from the scanner output, and the truncated source context does not include the full lockfile, so the affected crate and its runtime reachability cannot be determined. As a Tauri desktop application, the project has a constrained attack surface. Without evidence of attacker-controlled input reaching the vulnerable code, this is a maintenance weakness.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a patched version when one is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0081

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0221 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a Cargo.lock dependency. The scanner confirms the version is present with high confidence, but package details were stripped and the supplied source is a truncated prefix of the lockfile, preventing identification of the specific crate or assessment of whether vulnerable code is reachable at runtime. The project is a desktop application, limiting network-driven exploitation. No attacker-controlled input path to the vulnerable code has been identified.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a version that resolves the advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0221

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0100 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a declared Cargo.lock dependency with high version-match confidence. Package details were removed from the scanner output, and the truncated source context does not cover the full lockfile, so the specific affected crate and its runtime reachability cannot be determined. The application is a Tauri desktop client with a limited attack surface. Without evidence of attacker-controlled input reaching the vulnerable code, this is a dependency hygiene issue.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a patched version when available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0100

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: The scanner flagged a high-severity advisory but removed the affected package name and version. The supplied lockfile context is truncated to the top-level dependency declarations, so the specific vulnerable package, its resolved version, and whether the vulnerable code path is reachable at runtime cannot be confirmed. The project is a Tauri desktop frontend; several declared dependencies are dev-only (build tooling) and are not shipped to end users. If the advisory targets a dev-only package such as a bundler or linter, production users are unaffected. If it targets a runtime dependency, the Tauri webview context limits some web-oriented attack surfaces. Without the package identity, a material conclusion cannot be reached.

Impact: low · Exploitability: plausible

Developer action: Identify which package the advisory maps to, confirm the resolved version in the lockfile, and update it if a fixed version is available. If the package is a dev-only dependency, document that it does not ship to end users.

Scanner

osv-scanner 2.4.0

Rule

GHSA-r28c-9q8g-f849

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0416 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a Cargo.lock dependency. The scanner confirms the vulnerable version is present with high confidence, but the specific package name and advisory details were stripped from the output. The supplied source is a truncated prefix of the full lockfile, preventing identification of the affected crate or assessment of runtime reachability. As a Tauri desktop application, the project has a constrained network attack surface. No attacker-controlled input path to the vulnerable code has been identified.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a version that resolves the advisory.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0416

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: The scanner flagged a medium-severity advisory but removed the affected package details. The truncated lockfile context shows only top-level dependency ranges, not the full tree of resolved transitive versions. Without the package identity, runtime reachability and concrete user harm cannot be determined. The project is a Tauri desktop frontend with no exposed web server in production, which reduces the impact of many web-oriented dependency vulnerabilities. The advisory severity alone is insufficient to conclude material risk.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package from the advisory, verify the resolved version in the lockfile, and upgrade if a patched release exists.

Scanner

osv-scanner 2.4.0

Rule

GHSA-fxqj-rqcc-2cmp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2026-0194 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity Rust advisory against a declared Cargo.lock dependency with high version-match confidence. Package details were removed from the scanner output, and the truncated source context does not include the full lockfile, so the specific affected crate and its runtime reachability cannot be determined. The project is a Tauri desktop application with limited exposure to network-driven exploitation of dependency-level issues. Without evidence of attacker-controlled input reaching the vulnerable code, this is a maintenance weakness.

Impact: low · Exploitability: unlikely

Developer action: Update the affected Rust dependency to a patched version when one is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2026-0194

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0411 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0411 against a dependency declared in this production Cargo.lock at medium severity. The scanner removed package details, and the supplied source context covers only the first portion of a large lock file, so the specific affected crate and its version cannot be confirmed from the evidence. This is a Tauri desktop application with a client-side attack surface; without identifying the package or its runtime reachability, concrete user harm cannot be established beyond the advisory's general medium-severity classification.

Impact: low · Exploitability: unlikely

Developer action: Update affected Rust dependencies to versions that resolve RUSTSEC-2024-0411 when a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0411

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2025-0080 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2025-0080 against a dependency in this production Cargo.lock at medium severity. Package details were stripped by the scanner, and the partial source context does not include enough of the lock file to identify the affected crate or confirm its version. The project is a desktop client with outbound HTTPS calls to LLM providers; without knowing which crate is involved or whether attacker-controlled input reaches the vulnerable code path, the advisory cannot be elevated beyond a general dependency hygiene concern.

Impact: low · Exploitability: unlikely

Developer action: Update affected Rust dependencies to versions that resolve RUSTSEC-2025-0080 when a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2025-0080

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0418 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0418 against a dependency in this production Cargo.lock at medium severity. The scanner removed package identifiers, and the supplied lock-file excerpt does not span enough entries to pinpoint the affected crate or its resolved version. As a Tauri desktop application, the primary untrusted inputs are imported character card files and LLM API responses, but without identifying the vulnerable crate there is no basis to conclude that attacker-controlled data reaches the vulnerable code path.

Impact: low · Exploitability: unlikely

Developer action: Update affected Rust dependencies to versions that resolve RUSTSEC-2024-0418 when a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0418

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0414 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0414 against a dependency in this production Cargo.lock at medium severity. Package details were removed by the scanner, and the partial source context does not allow identification of the affected crate or verification of its version. The project is a client-side desktop application with limited exposure; without confirming runtime reachability or attacker input paths, the advisory remains a dependency maintenance item rather than a confirmed exploitable vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Update affected Rust dependencies to versions that resolve RUSTSEC-2024-0414 when a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0414

File role

production

Source

src-tauri/Cargo.lock

Scanner reason: OSV-Scanner matched advisory RUSTSEC-2024-0420 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched RUSTSEC-2024-0420 against a dependency in this production Cargo.lock at medium severity. The scanner stripped package details, and the supplied lock-file excerpt covers only the first several hundred lines of a large file, so the affected crate and its resolved version cannot be determined. This is a desktop application whose attack surface consists mainly of imported character cards and LLM provider responses; without identifying the vulnerable crate, there is insufficient evidence to establish runtime reachability or concrete user harm.

Impact: low · Exploitability: unlikely

Developer action: Update affected Rust dependencies to versions that resolve RUSTSEC-2024-0420 when a patched version is available.

Scanner

osv-scanner 2.4.0

Rule

RUSTSEC-2024-0420

File role

production

Source

src-tauri/Cargo.lock

All eight candidates are OSV-Scanner matches for known advisories against dependency versions in the Cargo.lock of a Tauri desktop AI chat client. All are rated medium severity by the scanner. The scanner output did not include specific package names, and only the first approximately 641 lines of the 133KB lockfile were provided as context, preventing per-advisory runtime reachability analysis. The project makes outbound HTTPS requests to LLM provider APIs and parses PNG character cards, so TLS, HTTP, and image-parsing dependencies would be the most security-relevant if any of these advisories target those crates. However, medium-severity Rust advisories commonly involve build-time issues, unmaintained-crate warnings, or edge-case panics with limited practical exploitability in a desktop client. A routine dependency update pass would address all eight advisories.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit and update all flagged crates to versions that resolve the matched advisories, then regenerate the Cargo.lock.

Sources:

• src-tauri/Cargo.lock:1