PatchSiren cyber security CVE debrief

CVE-2026-44652 SillyTavern CVE debrief

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.18.0, the corsProxyMiddleware component forwards req.params.url directly into a fetch(url, ...) call without adequate validation. The middleware only blocks circular requests to its own host and does not enforce a destination allowlist or restrict access to private or loopback addresses. This design gap enables Server-Side Request Forgery (SSRF), allowing an attacker to induce the application to make requests to arbitrary internal or external destinations. The vulnerability is classified under CWE-918 (Server-Side Request Forgery) and has been assigned a CVSS 4.0 vector indicating network accessibility with low attack complexity and no required privileges or user interaction. The issue was remediated in version 1.18.0.

Vendor: SillyTavern
Product: Unknown
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-29
Original CVE updated: 2026-05-29
Advisory published: 2026-05-29
Advisory updated: 2026-05-29

Who should care

Organizations and individuals running SillyTavern instances, particularly those exposed to untrusted networks or hosting the application in environments with access to sensitive internal services

Technical summary

The corsProxyMiddleware in SillyTavern prior to 1.18.0 accepts a user-controlled URL parameter and passes it directly to a fetch() call. The middleware implements only minimal validation—blocking requests that would loop back to the application's own host—while failing to restrict destinations to an allowlist or block private IP ranges and loopback interfaces. This insufficient validation allows attackers to specify arbitrary URLs, including internal services and cloud metadata endpoints, resulting in Server-Side Request Forgery. The vulnerability is exploitable over the network without authentication and has been addressed in version 1.18.0.

Defensive priority

medium

Recommended defensive actions

Upgrade SillyTavern to version 1.18.0 or later to remediate the SSRF vulnerability in corsProxyMiddleware
If immediate patching is not feasible, restrict network access to the SillyTavern instance to trusted hosts only
Review and implement destination allowlist controls for any custom proxy middleware configurations
Monitor application logs for anomalous outbound requests that may indicate SSRF exploitation attempts
Assess internal network segmentation to limit potential impact from successful SSRF attacks

Evidence notes

Vulnerability description and remediation status sourced from official CVE record and NVD entry. Fix version and technical details confirmed via GitHub Security Advisory. CVSS vector and CWE classification provided by NVD.

Official resources

2026-05-29