PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44652 SillyTavern CVE debrief

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.18.0, the corsProxyMiddleware component forwards req.params.url directly into a fetch(url, ...) call without adequate validation. The middleware only blocks circular requests to its own host and does not enforce a destination allowlist or restrict access to private or loopback addresses. This design gap enables Server-Side Request Forgery (SSRF), allowing an attacker to induce the application to make requests to arbitrary internal or external destinations. The vulnerability is classified under CWE-918 (Server-Side Request Forgery) and has been assigned a CVSS 4.0 vector indicating network accessibility with low attack complexity and no required privileges or user interaction. The issue was remediated in version 1.18.0.

Vendor
SillyTavern
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations and individuals running SillyTavern instances, particularly those exposed to untrusted networks or hosting the application in environments with access to sensitive internal services

Technical summary

The corsProxyMiddleware in SillyTavern prior to 1.18.0 accepts a user-controlled URL parameter and passes it directly to a fetch() call. The middleware implements only minimal validation—blocking requests that would loop back to the application's own host—while failing to restrict destinations to an allowlist or block private IP ranges and loopback interfaces. This insufficient validation allows attackers to specify arbitrary URLs, including internal services and cloud metadata endpoints, resulting in Server-Side Request Forgery. The vulnerability is exploitable over the network without authentication and has been addressed in version 1.18.0.

Defensive priority

medium

Recommended defensive actions

  • Upgrade SillyTavern to version 1.18.0 or later to remediate the SSRF vulnerability in corsProxyMiddleware
  • If immediate patching is not feasible, restrict network access to the SillyTavern instance to trusted hosts only
  • Review and implement destination allowlist controls for any custom proxy middleware configurations
  • Monitor application logs for anomalous outbound requests that may indicate SSRF exploitation attempts
  • Assess internal network segmentation to limit potential impact from successful SSRF attacks

Evidence notes

Vulnerability description and remediation status sourced from official CVE record and NVD entry. Fix version and technical details confirmed via GitHub Security Advisory. CVSS vector and CWE classification provided by NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44652 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44652

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44652 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44652

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.