Skip to content
OpenAdvisories

Vendor

SillyTavern

13 known vulnerabilities.

Products

SillyTavern 13
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2026-44648 Public exploit

    SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, st…

    SillyTavern SillyTavern sillytavern npm
  • High 8.5
    CVE-2026-46372 Scanner template

    SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts atta…

    SillyTavern SillyTavern sillytavern npm
  • High 8.3
    CVE-2026-34524

    SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints al…

    SillyTavern SillyTavern sillytavern npm
  • High 8.1
    CVE-2026-34522

    SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import…

    SillyTavern SillyTavern sillytavern npm
  • High 7.1
    CVE-2026-26286

    SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerabil…

    SillyTavern SillyTavern