CVE-2026-44652: Sillytavern SillyTavern Has A SSRF Vulnerability Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-ccfq-2454-f5xw",
  "modified" : "2026-06-09T10:32:18Z",
  "published" : "2026-05-12T22:24:05Z",
  "aliases" : [ "CVE-2026-44652" ],
  "summary" : "SillyTavern has a SSRF vulnerability in the CORS proxy middleware",
  "details" : "## Resolution\n\nSillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.\n\nDocumentation: \n\n- https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelisting\n- https://docs.sillytavern.app/administration/#security-checklist\n\n## Note on future SSRF findings\n\nSince the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.\n\n## Overview\n- Vulnerability Type: SSRF\n- Affected Location: `src/middleware/corsProxy.js:31`\n- Trigger Scenario: SSRF in optional CORS proxy\n\n## Root Cause\n`corsProxyMiddleware` forwards `req.params.url` directly into `fetch(url, ...)`. It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF.\n\n## Source-to-Sink Chain\n1. Source (user-controlled input)\n- Entry point: `GET /proxy/:url(*)`\n\n2. Data flow\n- Code analysis shows concrete propagation into this sink:\n  - vulnerability title: `SSRF in optional CORS proxy`\n  - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:31`\n- The same sink behavior is confirmed by controlled execution observations.\n\n3. Sink (dangerous operation)\n- Sink location: `src/middleware/corsProxy.js:31`\n- Vulnerable behavior: SSRF in optional CORS proxy\n\n## Exploitation Preconditions\n1. The attacker can control or influence a URL/endpoint parameter.\n2. The server can access internal or sensitive network targets.\n3. Outbound request validation or redirect controls are insufficient.\n\n## Risk\nThis issue can be used to pivot network access and reach unintended internal resources.\n\n## Impact\nAn attacker may access internal network services or metadata endpoints and exfiltrate sensitive responses.\n\n## Remediation\n1. Enforce strict destination allowlist for proxy targets.\n2. Block loopback, link-local, RFC1918, and metadata address ranges.\n3. Apply the same destination validation to redirects.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "sillytavern"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.18.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.17.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-ccfq-2454-f5xw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44652"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/SillyTavern/SillyTavern"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-12T22:24:05Z",
    "nvd_published_at" : "2026-05-29T19:16:25Z"
  }
}