CVE-2026-44651
Severity CVSS v4.0:
MEDIUM
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
29/05/2026
Last modified:
29/05/2026
Description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends:<br />
res.status(500).send(&#39;Error occurred while trying to proxy to: &#39; + url + &#39; &#39; + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM