Executive brief
SillyTavern is a user interface for interacting with AI models and text-to-speech engines. A security flaw allows authenticated users to bypass internal network protections and force the server to access local or private network resources. While the impact is limited to services running on standard web ports (80 and 443), an attacker could potentially view sensitive internal data or metadata that should not be accessible from the interface.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in SillyTavern's `src/endpoints/search.js` component. The application attempts to block access to internal addresses using a regular expression that only matches literal dotted-quad IPv4 addresses. This validation fails to account for 'localhost', IPv6 loopback addresses ([::1]), or DNS names that resolve to internal IPs. An authenticated attacker can exploit this to force the server to fetch and return content from internal network resources. The impact is partially mitigated by a secondary check that restricts requests to the default ports 80 and 443. The issue is resolved in version 1.17.0.
Affected products
- SillyTavern SillyTavern < 1.17.0
Timeline
- 2026-03-28: patched: Version 1.17.0 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34526 published to NVD