| Fixing_vulnerabilities |
| 0 |
| url |
VCID-19pk-pc1p-6yej |
| vulnerability_id |
VCID-19pk-pc1p-6yej |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers to automatically log in users when SSO is configured. There is no validation that these headers originate from a trusted reverse proxy. Any network client that can reach the SillyTavern port directly can inject these headers and authenticate as any user, including administrators, without a password. This vulnerability is exploitable only when sso.autheliaAuth: true or sso.authentikAuth: true is set in config.yaml (both default to false). This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44649, GHSA-gxx6-h3g6-vwjh
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-19pk-pc1p-6yej |
|
| 1 |
| url |
VCID-r4a6-dvbb-13fz |
| vulnerability_id |
VCID-r4a6-dvbb-13fz |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in the default configuration. This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44650, GHSA-886q-f44j-h6wh
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r4a6-dvbb-13fz |
|
| 2 |
| url |
VCID-r5cw-d7g3-j7cr |
| vulnerability_id |
VCID-r5cw-d7g3-j7cr |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data (user handle, permissions) in a signed cookie. The endpoints POST /api/users/change-password and POST /api/users/recover-step2 only update the password hash in the database but do not expire current sessions. Because the session is stateless and stored entirely in the client cookie, there is no server-side mechanism to revoke a token once issued. This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44648, GHSA-wmm3-h9qj-p5v6
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r5cw-d7g3-j7cr |
|
| 3 |
| url |
VCID-tytb-3a67-jka2 |
| vulnerability_id |
VCID-tytb-3a67-jka2 |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:
res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44651, GHSA-xc4x-2452-5gc9
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tytb-3a67-jka2 |
|
| 4 |
| url |
VCID-zdfr-hr2y-yycs |
| vulnerability_id |
VCID-zdfr-hr2y-yycs |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into fetch(url, ...). It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF. This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44652, GHSA-ccfq-2454-f5xw
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zdfr-hr2y-yycs |
|
| 5 |
| url |
VCID-zyu8-bztz-pqhc |
| vulnerability_id |
VCID-zyu8-bztz-pqhc |
| summary |
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body. This vulnerability is fixed in 1.18.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-46372, GHSA-qg89-qwwh-5f3j
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zyu8-bztz-pqhc |
|
|
|---|