MEDIUM5.3npm
GHSA-525j-2hrj-m8fp· CVE-2026-34523SillyTavern: Path Traversal allows file existence oracle
Modified: 4/6/2026
package
npm/sillytavern
pkg:npm/sillytavern
CRITICAL9.6npm
GHSA-7cxj-w27x-x78q· CVE-2025-59159SillyTavern Web Interface Vulnerable DNS Rebinding
Modified: 10/6/2025
CRITICAL9.1npm
GHSA-886q-f44j-h6wh· CVE-2026-44650SillyTavern has a Path Traversal issue
Modified: 5/12/2026
MEDIUMnpm
GHSA-ccfq-2454-f5xw· CVE-2026-44652SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Modified: 6/9/2026
CRITICAL9.8npm
GHSA-gxx6-h3g6-vwjh· CVE-2026-44649SillyTavern has Authentication Bypass via SSO Header Injection
Modified: 6/9/2026
HIGH8.5npm
GHSA-qg89-qwwh-5f3j· CVE-2026-46372SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
Modified: 6/9/2026
HIGH8.3npm
GHSA-vprr-q85p-79mf· CVE-2026-34524SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
Modified: 4/6/2026
MEDIUM5.0npm
GHSA-wm7j-m6jm-8797· CVE-2026-34526SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
Modified: 4/6/2026
HIGH7.5npm
GHSA-wmm3-h9qj-p5v6· CVE-2026-44648SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
Modified: 6/9/2026
MEDIUMnpm
GHSA-xc4x-2452-5gc9· CVE-2026-44651SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Modified: 6/9/2026
HIGH8.1npm
GHSA-xvww-xhx6-22pf· CVE-2026-34522SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
Modified: 4/6/2026