OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension intentionally lets the user enter custom tracker code and runs it. That is powerful and can access the SillyTavern page, but the supplied evidence shows it is a user-configured feature rather than hidden code executing on its own.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The setting handler stores user-supplied mesTrackerJavascript and immediately invokes processTrackerJavascript. That function evaluates the setting as a function or object, assigns the resulting object as the global tracker, and may invoke its init and cleanup methods. This provides arbitrary same-page JavaScript execution, but the supplied flow shows a visible customization mechanism and no evidence of remote input, concealed execution, credential access, or exfiltration.
Impact: high · Exploitability: readily_exploitable
Developer action: Document clearly that this setting executes arbitrary JavaScript, add prominent warnings and confirmation before execution, and replace dynamic execution with a constrained declarative configuration or sandbox where feasible.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- src/settings/settings.js:613