86482t/SillyTavern-Personage

Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.

Contextual assessment: The root package declares only devDependencies (build tooling). The shipped extension artifact is a webpack-bundled dist/index.js and dist/style.css; node_modules and build-tool transitive dependencies are not distributed to end users. This advisory flags a transitive dev-only dependency with no runtime reachability in the shipped extension. Attacker-controlled input would need to reach the vulnerable code during a local build of the developer's own source, which is an unlikely scenario.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-4x5r-pxfx-6jf8

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp to a dependency declared by this repository.

Contextual assessment: The root package has no runtime dependencies; all entries in the lockfile are transitive devDependencies of webpack, babel, or terser build tooling. The advisory targets a build-chain package that is not bundled into the shipped dist output and therefore has no runtime reachability for extension users. Exploitation would require attacker-controlled input processed by the build tool during local compilation, which does not occur in normal use.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-fv7c-fp4j-7gwp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: The project's package.json declares only devDependencies for the build pipeline. The vulnerable transitive dependency is part of the build toolchain and is not included in the webpack-bundled dist artifact that SillyTavern loads. No attacker-controlled input reaches the vulnerable code at runtime in the shipped extension.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-v2hh-gcrm-f6hx

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: The advisory matches a transitive dependency resolved in the pnpm lockfile for a project whose only declared dependencies are devDependencies: @babel/preset-env, babel-loader, terser-webpack-plugin, and webpack-cli. These are build-time tooling packages used to produce the bundled dist/index.js and dist/style.css. The vulnerable code is not shipped to end users of the SillyTavern extension; it exists only in the developer's local build environment. Runtime reachability for extension users is absent. The advisory severity reflects the vulnerable package in isolation, not the constrained context of a dev-only build toolchain.

Impact: low · Exploitability: unlikely

Developer action: Update the affected build-time dependency to a patched version when convenient to keep the development environment current.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7p8r-x3mc-p8w7

File role

production

Source

pnpm-lock.yaml

Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc to a dependency declared by this repository.

Contextual assessment: All dependencies in this lockfile derive from the four declared devDependencies (babel, babel-loader, terser-webpack-plugin, webpack-cli). The advisory covers a transitive build-tool dependency with no path into the shipped dist bundle. Runtime reachability for end users is absent; exploitation would require a malicious build-time input scenario that does not apply to this project's workflow.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-v39h-62p7-jpjc

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6 to a dependency declared by this repository.

Contextual assessment: The root package declares no runtime dependencies, so every package in the lockfile is a dev-only transitive dependency of the build toolchain. The flagged package is not bundled into the shipped dist/index.js and has no runtime reachability in the extension. The vulnerable code would only execute during a local build processing the developer's own source code.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-q3j6-qgpj-74h6

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: This advisory flags a transitive dependency of the declared build tooling. Because the project has only devDependencies and ships a webpack bundle, the vulnerable package is not present in the extension artifact loaded by SillyTavern. There is no runtime data flow from extension inputs to the vulnerable code.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7p8r-x3mc-p8w7

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: The lockfile root entry shows only devDependencies for the webpack and babel build pipeline. The advisory targets a transitive build-tool dependency that is excluded from the bundled dist output. No extension runtime path reaches the vulnerable code, and attacker-controlled input does not flow into the build process during normal development.

Impact: none · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-4c8g-83qw-93j6

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: This advisory also matches a transitive dependency in the pnpm lockfile that originates from the project's devDependencies (webpack/babel build toolchain). The shipped extension artifact is a bundled client-side JavaScript file loaded by SillyTavern; the vulnerable dependency code is not part of that bundle. There is no runtime path from extension user activity to the vulnerable package. The advisory's high severity applies to the package in general use, not to this dev-only, non-shipped context.

Impact: low · Exploitability: unlikely

Developer action: Update the affected build-time dependency to a patched version when convenient to keep the development environment current.

Scanner

osv-scanner 2.4.0

Rule

GHSA-v2hh-gcrm-f6hx

File role

production

Source

pnpm-lock.yaml

The root package entry in the lockfile declares only devDependencies and no runtime dependencies. The shipped extension consists of a webpack-bundled dist/index.js and dist/style.css loaded via manifest.json. All seven advisories target transitive dependencies of the build toolchain (babel, webpack, terser) that are not included in the bundled output. There is no runtime data flow from extension inputs to any of these packages. A single routine update of the build tooling devDependencies would resolve multiple advisories simultaneously.

Impact: none · Exploitability: unlikely

Developer action: Run a devDependency update pass to pull patched versions of the build toolchain and regenerate the lockfile.

Sources:

• package-lock.json:7-16