{"id":"CVE-2026-44651","aliases":["EUVD-2026-33405","GHSA-xc4x-2452-5gc9"],"status":"published","title":"SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:\nres.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00323,"percentile":0.25662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-12T22:23:56Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"npm","package":"sillytavern","fixed_in":["1.18.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sillytavern","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.17.0"},{"fixed":"1.18.0"}]}]},{"source":"osv","ecosystem":"npm","package":"sillytavern","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.0"}]}]}],"products":[{"vendor":"sillytavern","product":"sillytavern"}],"references":[{"url":"https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-xc4x-2452-5gc9","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44651","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xc4x-2452-5gc9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44651.json","tags":["advisory"]},{"url":"https://github.com/SillyTavern/SillyTavern","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44651","title":"SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:\nres.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.","status":"published","published":"2026-05-29T17:49:19.494Z","modified":"2026-06-01T15:20:31.759Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-33405","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:\nres.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.","status":"published","published":"2026-05-29T17:49:19Z","modified":"2026-06-01T15:20:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:58.316953Z"}],"ghsa":[{"id":"GHSA-xc4x-2452-5gc9","title":"SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware","description":"## Resolution\n\nFixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.\n\n## Overview\n- Vulnerability Type: XSS\n- Affected Location: `src/middleware/corsProxy.js:40`\n- Trigger Scenario: reflected XSS in CORS proxy error response\n\n## Root Cause\nWhen `fetch(url)` throws, the code sends:\n`res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)`.\nThe `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering.\n\n## Source-to-Sink Chain\n1. Source (user-controlled input)\n- Entry point: `GET /proxy/:url(*)`\n\n2. Data flow\n- Code analysis shows concrete propagation into this sink:\n  - vulnerability title: `Reflected XSS in CORS proxy error response`\n  - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40`\n- The same sink behavior is confirmed by controlled execution observations.\n\n3. Sink (dangerous operation)\n- Sink location: `src/middleware/corsProxy.js:40`\n- Vulnerable behavior: reflected XSS in CORS proxy error response\n\n## Exploitation Preconditions\n1. The attacker can inject controllable content into a rendered response.\n2. The vulnerable rendering context does not apply strict output encoding/sanitization.\n3. A victim user opens the affected page or response.\n\n## Risk\nThis issue enables script execution in the victim context and can compromise session or data integrity.\n\n## Impact\nAn attacker may run arbitrary JavaScript in the victim context, steal tokens, and manipulate user-visible behavior.\n\n## Remediation\n1. Never concatenate raw user input into HTML error responses.\n2. If URL echo is required, HTML-escape it or force plain-text output.\n3. Re-enable/strengthen CSP to reduce reflected injection impact.","status":"published","published":"2026-05-12T22:23:56Z","modified":"2026-06-09T10:32:15Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-44651","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:\nres.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.","status":"published","published":"2026-05-29T19:16:24.993Z","modified":"2026-07-22T06:10:00.17Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-44651","title":"SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:\nres.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.","status":"published","published":"2026-05-29T17:49:19.494Z","modified":"2026-10-28T02:31:08.152757582Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-xc4x-2452-5gc9","title":"SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware","description":"## Resolution\n\nFixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.\n\n## Overview\n- Vulnerability Type: XSS\n- Affected Location: `src/middleware/corsProxy.js:40`\n- Trigger Scenario: reflected XSS in CORS proxy error response\n\n## Root Cause\nWhen `fetch(url)` throws, the code sends:\n`res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)`.\nThe `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering.\n\n## Source-to-Sink Chain\n1. Source (user-controlled input)\n- Entry point: `GET /proxy/:url(*)`\n\n2. Data flow\n- Code analysis shows concrete propagation into this sink:\n  - vulnerability title: `Reflected XSS in CORS proxy error response`\n  - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40`\n- The same sink behavior is confirmed by controlled execution observations.\n\n3. Sink (dangerous operation)\n- Sink location: `src/middleware/corsProxy.js:40`\n- Vulnerable behavior: reflected XSS in CORS proxy error response\n\n## Exploitation Preconditions\n1. The attacker can inject controllable content into a rendered response.\n2. The vulnerable rendering context does not apply strict output encoding/sanitization.\n3. A victim user opens the affected page or response.\n\n## Risk\nThis issue enables script execution in the victim context and can compromise session or data integrity.\n\n## Impact\nAn attacker may run arbitrary JavaScript in the victim context, steal tokens, and manipulate user-visible behavior.\n\n## Remediation\n1. Never concatenate raw user input into HTML error responses.\n2. If URL echo is required, HTML-escape it or force plain-text output.\n3. Re-enable/strengthen CSP to reduce reflected injection impact.","status":"published","published":"2026-05-12T22:23:56Z","modified":"2026-06-09T10:45:18.459862365Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}