A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The release workflow uses an outdated GitHub action that is no longer maintained. This is a maintenance issue rather than a security threat. It does not put users of the extension at risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule archived-uses. The match applies to this repository.
Contextual assessment: The workflow references a deprecated GitHub-provided release action pinned to a major version tag rather than a commit SHA. This is a maintenance and supply-chain hygiene concern: the action is no longer maintained and major-version tags can move. No attacker-controlled input reaches the action in a way that causes concrete harm, and the token used is the standard scoped GitHub Actions token. No exfiltration, persistence, or code execution beyond normal release automation is demonstrated.
Impact: low · Exploitability: unlikely
Developer action: Replace the deprecated release action with a maintained alternative or the GitHub CLI release command, and consider pinning actions to commit SHAs.
The workflow checks out code using a movable version label instead of a fixed reference. This is a minor best-practice issue, not an active security problem.
Technical assessment
The checkout step uses a major version tag instead of a commit SHA, which is a common supply-chain hygiene weakness. No attacker-controlled data flow is demonstrated here.
Impact: low · Exploitability: unlikely
Developer action: Pin actions to immutable commit SHAs for reproducibility.
The workflow briefly saves a GitHub token to a file on a temporary build machine. This is not ideal practice but does not expose the token to outside parties.
Technical assessment
A step writes the GitHub token to a file on the runner. The token is the standard scoped Actions token and the runner is ephemeral, so this is a hygiene issue rather than a demonstrated exposure.
Impact: low · Exploitability: unlikely
Developer action: Avoid writing tokens to disk; pass them through environment variables only.