Executive brief
SillyTavern is a web-based interface for managing AI chatbots. A DNS rebinding vulnerability allows unauthenticated attackers to bypass security controls and gain remote access to a user's local SillyTavern instance simply by tricking them into visiting a malicious website. An attacker could read all user conversations, install malicious extensions, inject phishing content, or take complete control of the system.
Technical details
The vulnerability is a DNS rebinding attack (CWE-346, CWE-940) that exploits insufficient origin validation in the SillyTavern web interface. The web UI does not properly verify the source of incoming HTTP requests, allowing an attacker to craft a malicious webpage that uses DNS rebinding techniques to redirect browser requests to localhost (127.0.0.1) after initially resolving to the attacker's IP. This bypasses CORS (Cross-Origin Resource Sharing) protections. The attack requires user interaction (visiting the malicious site) but no authentication or special privileges. Once exploited, an attacker gains full control over the victim's SillyTavern instance, including ability to read chats, modify data, and execute arbitrary actions. A patch was released in version 1.13.4 introducing optional host whitelisting validation via the hostWhitelist.enabled configuration setting.
Affected products
- SillyTavern SillyTavern <1.13.4
Timeline
- 2025-10-06: disclosed
- 2025-10-06: patched: Version 1.13.4 with host whitelisting feature