CVE-2026-44652 SillyTavern: SSRF vulnerability in the CORS proxy middleware
Attackers can exploit the CORS proxy to perform Server-Side Request Forgery, accessing internal resources or bypassing network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44652?
CVE-2026-44652 is a medium-severity server-side request forgery vulnerability in SillyTavern, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into fetch(url, ...). It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF. This vulnerability is fixed in 1.18.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-44652?
2 open source packages ship an affected version, including sillytavern.
| Package | Affected | Fixed in |
|---|---|---|
sillytavern npm | All versions | 1.18.0 |
sillytavern npm | All versions | 1.18.0 |
How do I fix CVE-2026-44652?
Upgrade sillytavern to 1.18.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44652 being exploited?
There is no known exploitation of CVE-2026-44652 in the wild and no public exploit code.
Sources
Also known as GHSA-ccfq-2454-f5xw.