pkg:npm/sillytavern

11 total CVEsCRITICAL3HIGH4MEDIUM2

✅ Check your installed version

All known vulnerabilities

  • CRITICAL9.8CVE-2026-44649SillyTavern has Authentication Bypass via SSO Header Injection
    from 0, < 1.18.0
  • CRITICAL9.6CVE-2025-59159SillyTavern Web Interface Vulnerable DNS Rebinding
    from 0, < 1.13.4
  • CRITICAL9.1CVE-2026-44650SillyTavern has a Path Traversal issue
    from 0, < 1.18.0
  • HIGH8.5CVE-2026-46372SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
    from 0, < 1.18.0
  • HIGH8.3CVE-2026-34524SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
    from 0, < 1.17.0
  • HIGH8.1CVE-2026-34522SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
    from 0, < 1.17.0
  • HIGH7.5CVE-2026-44648SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
    from 0, < 1.18.0
  • MEDIUM5.3CVE-2026-34523SillyTavern: Path Traversal allows file existence oracle
    from 0, < 1.17.0
  • MEDIUM5.0CVE-2026-34526SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
    from 0, < 1.17.0
  • —CVE-2026-44652SillyTavern has a SSRF vulnerability in the CORS proxy middleware
    from 0, < 1.18.0
  • —CVE-2026-44651SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
    from 0, < 1.18.0