CVE-2026-44651 Overview
CVE-2026-44651 is a reflected Cross-Site Scripting (XSS) vulnerability in SillyTavern, a locally installed user interface for interacting with large language models, image generation engines, and text-to-speech voice models. The flaw resides in the proxy error handler. When fetch(url) throws, the application returns an HTTP 500 response containing the attacker-controlled req.params.url value without HTML escaping. An attacker who induces a victim to load a crafted URL through the proxy endpoint can execute arbitrary JavaScript in the victim's browser context. The vulnerability is tracked under [CWE-79] and is fixed in SillyTavern 1.18.0.
Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling theft of session data, manipulation of the SillyTavern interface, and access to connected LLM and TTS backends.
Affected Products
- SillyTavern versions prior to 1.18.0
- Local deployments exposing the proxy endpoint to untrusted clients
- Multi-user SillyTavern instances accessible across a network
Discovery Timeline
- 2026-05-29 - CVE-2026-44651 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-44651
Vulnerability Analysis
The vulnerability stems from unsafe error reflection in the SillyTavern proxy handler. When the server attempts to fetch a remote resource using fetch(url) and the call throws, the handler responds with res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value comes directly from req.params.url and is concatenated into the response body without HTML encoding.
Browsers render this 500 response as HTML by default. An attacker can supply a url parameter containing HTML or script tags. When fetch fails, for example due to an invalid scheme or unreachable host, the malicious payload is echoed back and executed in the victim's browser. This produces a classic reflected XSS condition aligned with [CWE-79].
Because SillyTavern is typically loaded with authenticated sessions and stores credentials for downstream LLM, image, and TTS providers, executed scripts can read session state, exfiltrate API keys held in the page context, and issue requests against connected backends.
Root Cause
The root cause is missing output encoding on a user-controlled input rendered into an HTML response. The proxy error handler trusts req.params.url and includes it verbatim in the response body. No template escaping, sanitization, or content-type hardening prevents browser interpretation of the payload.
Attack Vector
Exploitation requires a network-reachable SillyTavern instance and a victim that loads an attacker-crafted link or embedded resource targeting the vulnerable proxy route. No authentication is required to trigger the error path, and no user interaction beyond visiting the URL is needed. The attacker forces fetch to throw by supplying a malformed or unresolvable URL containing the XSS payload appended to or substituted for the url parameter. The 500 response then reflects the payload into the victim's browser. See the GitHub Security Advisory for additional technical detail.
Detection Methods for CVE-2026-44651
Indicators of Compromise
- HTTP 500 responses from the SillyTavern proxy route containing <script>, onerror=, or other HTML markup in the response body
- Requests to the proxy endpoint where req.params.url contains HTML entities, angle brackets, or JavaScript URI schemes
- Outbound requests from browsers immediately following access to a SillyTavern proxy URL with suspicious parameters
Detection Strategies
- Inspect web server and reverse-proxy access logs for proxy requests containing encoded <, >, script, or javascript: substrings in the URL parameter
- Alert on SillyTavern responses with status 500 whose body length or content deviates from the expected plain-text error format
- Correlate browser-side errors or unexpected script execution with preceding requests to the SillyTavern proxy endpoint
Monitoring Recommendations
- Enable verbose access logging on the SillyTavern host and forward logs to a centralized analytics platform for query and retention
- Monitor for SillyTavern instances exposed beyond localhost, since the vulnerability is reachable from any client that can reach the proxy route
- Track installed SillyTavern versions across endpoints and flag any deployment running a release earlier than 1.18.0
How to Mitigate CVE-2026-44651
Immediate Actions Required
- Upgrade SillyTavern to version 1.18.0 or later, which applies HTML escaping to the reflected url value in the proxy error handler
- Restrict SillyTavern to 127.0.0.1 or place it behind authenticated reverse-proxy access until patching is complete
- Rotate any API keys or credentials stored in SillyTavern if the instance was exposed to untrusted networks
Patch Information
The fix is included in SillyTavern 1.18.0. Patched code escapes the url parameter before rendering it in the 500 error response, preventing browser interpretation of attacker-supplied markup. Refer to the GitHub Security Advisory GHSA-xc4x-2452-5gc9 for release details.
Workarounds
- Bind the SillyTavern listener to the loopback interface and disable remote access until the upgrade is applied
- Place SillyTavern behind a reverse proxy that rejects requests containing HTML metacharacters in the proxy URL parameter
- Apply a Content Security Policy that disallows inline scripts to limit the impact of reflected payloads
# Configuration example: restrict SillyTavern to localhost in config.yaml
listen: false
whitelistMode: true
whitelist:
- 127.0.0.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
