A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The extension stores a default address for a local image generation program that runs on your own computer. This is normal and safe because it only connects to your own computer.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a default configuration URL pointing to a local service (localhost:7860) for the Automatic1111 image generation backend. This is expected and necessary for the extension to function.
The extension needs to send prompts to image generation services over the internet or your local network. It also uses standard JavaScript functions like timeouts. This is how it works and is not dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The extension makes HTTP requests to image generation backends (local or external APIs) as part of its core function. The dynamic code execution sink likely refers to setTimeout or asynchronous callbacks, which are normal JavaScript patterns. No evidence of attacker-controlled input reaching a dangerous sink.