CVE-2026-44651
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
SillyTavern before version 1.18.0 does not HTML-escape attacker-controlled URL values before sending them in error responses. This allows cross-site scripting (XSS) via crafted requests.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, leading to session theft, data exfiltration, or account takeover.
Recommendation
Immediately update SillyTavern to version 1.18.0 or later.
Other vulnerabilities in SillyTavern
See all- CVE-2026-44650Critical
SillyTavern before version 1.18.0 has a vulnerability in the POST /api/extensions/delete endpoint that allows deletion of the entire user extensions directory by sending extensionName "." (dot). The sanitize-filename validation is bypassed, and no authentication is required in the default configuration.
- CVE-2026-44649Critical
SillyTavern, a locally installed user interface, accepts Remote-User and X-Authentik-Username HTTP headers for automatic login when SSO is configured, without validating they originate from a trusted proxy.
- CVE-2026-46372High
Vulnerability in SillyTavern before version 1.18.0. The /api/search/searxng endpoint accepts attacker-controlled baseUrl, enabling requests to internal or loopback HTTP services.
- CVE-2026-44652Medium
SillyTavern before version 1.18.0 contains an SSRF vulnerability in corsProxyMiddleware, which forwards the URL from req.params.url directly into fetch(). Only circular requests to its own host are blocked, with no destination allowlist or private/loopback restrictions.
- CVE-2026-44648High
SillyTavern before version 1.18.0 uses cookie-session for authentication, storing session data in a signed cookie. Password change endpoints do not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access after a password change.
- CVE-2026-34526Medium
In SillyTavern prior to version 1.17.0, an SSRF vulnerability was found in the search.js function. Hostname validation only covers dotted-quad IPv4, allowing bypass via localhost, IPv6, and DNS names resolving to internal addresses. A port check limits exploitation to default ports, reducing risk.
- CVE-2026-34524High
SillyTavern prior to version 1.17.0 contains a path traversal vulnerability in chat endpoints that allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.
- CVE-2026-34523Medium
SillyTavern before version 1.17.0 has a path traversal vulnerability in static file handling. An unauthenticated attacker can check for the existence of arbitrary files on the server by sending percent-encoded "../" sequences.
- CVE-2026-34522High
SillyTavern before version 1.17.0 contains a path traversal vulnerability in /api/chats/import, allowing authenticated attackers to write files outside the intended chats directory by injecting traversal sequences into character_name.
Original NVD description (English source)
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.