# sillytavern (npm) vulnerabilities 11 known vulnerabilities (3 critical, 4 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.19.0 (Sep 14, 2026): no advisory affects it - Newest unaffected release: 1.19.0 (Sep 14, 2026), the latest release - Weekly downloads: 940 - Dependents: 0 - Releases: 86 since 1.4.1 (Apr 22, 2023) - Registry: https://www.npmjs.com/package/sillytavern - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44651: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-44650: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-44648: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-44649: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-44652: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-46372: 1.4.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-34526: 1.4.1 to 1.16.0 (1.17.0 is outside it) - CVE-2026-34524: 1.4.1 to 1.16.0 (1.17.0 is outside it) - CVE-2026-34523: 1.4.1 to 1.16.0 (1.17.0 is outside it) - CVE-2026-34522: 1.4.1 to 1.16.0 (1.17.0 is outside it) - CVE-2025-59159: 1.4.1 to 1.13.3 (1.13.4 is outside it) ## Advisories (11) ### [CVE-2026-44651](https://cve.now/CVE-2026-44651): SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware - Severity: Medium 6.9 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-44650](https://cve.now/CVE-2026-44650): SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - Severity: Critical 9.1 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-44648](https://cve.now/CVE-2026-44648): SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover - Severity: High 7.5 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-44649](https://cve.now/CVE-2026-44649): SillyTavern: Authentication Bypass via SSO Header Injection - Severity: Critical 9.8 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-44652](https://cve.now/CVE-2026-44652): SillyTavern: SSRF vulnerability in the CORS proxy middleware - Severity: Medium 6.9 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-46372](https://cve.now/CVE-2026-46372): SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl - Severity: High 8.5 - Published: May 29, 2026 - Affected: fixed in 1.18.0. - Fixed in 1.18.0 (released May 3, 2026, 26 days before disclosure). - The latest release, 1.19.0, is not affected. - 70% of sillytavern downloads last week were affected versions (1.1K). ### [CVE-2026-34526](https://cve.now/CVE-2026-34526): SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 - Severity: Medium 5.0 - Published: Apr 2, 2026 - Affected: fixed in 1.17.0. - Fixed in 1.17.0 (released Mar 28, 2026, 5 days before disclosure). - The latest release, 1.19.0, is not affected. - 65% of sillytavern downloads last week were affected versions (1K). ### [CVE-2026-34524](https://cve.now/CVE-2026-34524): SillyTavern: Path traversal in \`/api/chats/export\` and \`/api/chats/delete\` allows arbitrary file read/delete within user data root - Severity: High 8.3 - Published: Apr 2, 2026 - Affected: fixed in 1.17.0. - Fixed in 1.17.0 (released Mar 28, 2026, 5 days before disclosure). - The latest release, 1.19.0, is not affected. - 65% of sillytavern downloads last week were affected versions (1K). ### [CVE-2026-34523](https://cve.now/CVE-2026-34523): SillyTavern: Path traversal allows file existence oracle - Severity: Medium 5.3 - Published: Apr 2, 2026 - Affected: fixed in 1.17.0. - Fixed in 1.17.0 (released Mar 28, 2026, 5 days before disclosure). - The latest release, 1.19.0, is not affected. - 65% of sillytavern downloads last week were affected versions (1K). ### [CVE-2026-34522](https://cve.now/CVE-2026-34522): SillyTavern: Path traversal in \`/api/chats/import\` allows arbitrary file write outside intended chat directory - Severity: High 8.1 - Published: Apr 2, 2026 - Affected: fixed in 1.17.0. - Fixed in 1.17.0 (released Mar 28, 2026, 5 days before disclosure). - The latest release, 1.19.0, is not affected. - 65% of sillytavern downloads last week were affected versions (1K). ### [CVE-2025-59159](https://cve.now/CVE-2025-59159): SillyTavern Web Interface Vulnerable to DNS Rebinding - Severity: Critical 9.7 - Published: Oct 6, 2025 - Affected: fixed in 1.13.4. - Fixed in 1.13.4 (released Sep 13, 2025, 23 days before disclosure). - The latest release, 1.19.0, is not affected. - 53% of sillytavern downloads last week were affected versions (847). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/sillytavern Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.