User Interface Vulnerability in SillyTavern by SillyTavern
CVE-2026-44652

6.9MEDIUM

Key Information:

Vendor

Sillytavern

Status
Sillytavern
Vendor
CVE Published:
29 May 2026

What is CVE-2026-44652?

SillyTavern, a locally installed user interface for interacting with various text and image generation models, suffers from a vulnerability prior to version 1.18.0. This issue arises from the functionality of corsProxyMiddleware, which forwards request parameters directly into fetch calls. The middleware only restricts circular requests to its host and fails to implement a destination allowlist, allowing for potential SSRF attacks. Users are encouraged to update to version 1.18.0 to mitigate these risks effectively.

Affected Version(s)

SillyTavern < 1.18.0

References

https://github.com/SillyTavern/SillyTavern/security/advis...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.