PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44651 SillyTavern CVE debrief

A reflected cross-site scripting (XSS) vulnerability exists in SillyTavern prior to version 1.18.0. The application is a locally installed user interface for interacting with text generation large language models, image generation engines, and text-to-speech voice models. When the `fetch(url)` function throws an exception, the error handling code constructs an HTTP 500 response that concatenates an attacker-controlled URL parameter (`req.params.url`) into the response body without HTML escaping. This allows an attacker to inject malicious JavaScript that executes in the context of the victim's browser session. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue was remediated in version 1.18.0. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and no user interaction, with low impacts to confidentiality and integrity.

Vendor
SillyTavern
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations and individuals running SillyTavern instances prior to 1.18.0, particularly those exposing the application to network access. Security teams responsible for local AI/LLM interface deployments should prioritize patching.

Technical summary

The vulnerability resides in error handling logic that constructs HTTP 500 responses. When `fetch(url)` throws, the code executes `res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)` where `url` is derived from `req.params.url`. The lack of HTML escaping permits injection of arbitrary markup and script content. This is a classic reflected XSS pattern where unsanitized user input is reflected back in the response. The attack requires the victim to visit a maliciously crafted URL containing the payload in the URL parameter.

Defensive priority

medium

Recommended defensive actions

  • Upgrade SillyTavern to version 1.18.0 or later to remediate this vulnerability
  • If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to detect and block requests containing malicious URL parameters targeting the affected endpoint
  • Review application logs for suspicious requests containing HTML or JavaScript payloads in URL parameters that may indicate exploitation attempts
  • Validate and sanitize all user-supplied URL parameters server-side before rendering in any response content
  • Consider implementing Content Security Policy (CSP) headers to mitigate the impact of any XSS vulnerabilities

Evidence notes

Vulnerability description confirms attacker-controlled `req.params.url` parameter is rendered without HTML escaping in error response. GitHub Security Advisory GHSA-xc4x-2452-5gc9 cited as primary source. Fix version 1.18.0 explicitly stated. CWE-79 classification confirmed in source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44651 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44651

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44651 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44651

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.