PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44651 SillyTavern CVE debrief

A reflected cross-site scripting (XSS) vulnerability exists in SillyTavern prior to version 1.18.0. The application is a locally installed user interface for interacting with text generation large language models, image generation engines, and text-to-speech voice models. When the `fetch(url)` function throws an exception, the error handling code constructs an HTTP 500 response that concatenates an attacker-controlled URL parameter (`req.params.url`) into the response body without HTML escaping. This allows an attacker to inject malicious JavaScript that executes in the context of the victim's browser session. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue was remediated in version 1.18.0. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and no user interaction, with low impacts to confidentiality and integrity.

Vendor
SillyTavern
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations and individuals running SillyTavern instances prior to 1.18.0, particularly those exposing the application to network access. Security teams responsible for local AI/LLM interface deployments should prioritize patching.

Technical summary

The vulnerability resides in error handling logic that constructs HTTP 500 responses. When `fetch(url)` throws, the code executes `res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)` where `url` is derived from `req.params.url`. The lack of HTML escaping permits injection of arbitrary markup and script content. This is a classic reflected XSS pattern where unsanitized user input is reflected back in the response. The attack requires the victim to visit a maliciously crafted URL containing the payload in the URL parameter.

Defensive priority

medium

Recommended defensive actions

  • Upgrade SillyTavern to version 1.18.0 or later to remediate this vulnerability
  • If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to detect and block requests containing malicious URL parameters targeting the affected endpoint
  • Review application logs for suspicious requests containing HTML or JavaScript payloads in URL parameters that may indicate exploitation attempts
  • Validate and sanitize all user-supplied URL parameters server-side before rendering in any response content
  • Consider implementing Content Security Policy (CSP) headers to mitigate the impact of any XSS vulnerabilities

Evidence notes

Vulnerability description confirms attacker-controlled `req.params.url` parameter is rendered without HTML escaping in error response. GitHub Security Advisory GHSA-xc4x-2452-5gc9 cited as primary source. Fix version 1.18.0 explicitly stated. CWE-79 classification confirmed in source metadata.

Official resources

2026-05-29