SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
MediumCVE-2026-44651 · Published May 12, 2026 · updated Jun 9, 2026
## Resolution Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body. ## Overview - Vulnerability Type: XSS - Affected Location: `src/middleware/corsProxy.js:40` - Trigger Scenario: reflected XSS in CORS proxy error response ## Root Cause When `fetch(url)` throws, the code sends: `res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)`. The `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering. ## Source-to-Sink Chain 1. Source (user-controlled input) - Entry point: `GET /proxy/:url(*)` 2. Data flow - Code analysis shows concrete propagation into this sink: - vulnerability title: `Reflected XSS in CORS proxy error response` - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40` - The same sink behavior is confirmed by controlled execution observations. 3. Sink (dangerous operation) - Sink location: `src/middleware/corsProxy.js:40` - Vulnerable behavior: reflected XSS in CORS proxy error response ## Exploitation Preconditions 1. The attacker can inject controllable content into a rendered response. 2. The vulnerable rendering c...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| sillytavern npm | < 1.18.0 | 1.18.0 |
Details and references
## Resolution Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body. ## Overview - Vulnerability Type: XSS - Affected Location: `src/middleware/corsProxy.js:40` - Trigger Scenario: reflected XSS in CORS proxy error response ## Root Cause When `fetch(url)` throws, the code sends: `res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error)`. The `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering. ## Source-to-Sink Chain 1. Source (user-controlled input) - Entry point: `GET /proxy/:url(*)` 2. Data flow - Code analysis shows concrete propagation into this sink: - vulnerability title: `Reflected XSS in CORS proxy error response` - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40` - The same sink behavior is confirmed by controlled execution observations. 3. Sink (dangerous operation) - Sink location: `src/middleware/corsProxy.js:40` - Vulnerable behavior: reflected XSS in CORS proxy error response ## Exploitation Preconditions 1. The attacker can inject controllable content into a rendered response. 2. The vulnerable rendering context does not apply strict output encoding/sanitization. 3. A victim user opens the affected page or response. ## Risk This issue enables script execution in the victim context and can compromise session or data integrity. ## Impact An attacker may run arbitrary JavaScript in the victim context, steal tokens, and manipulate user-visible behavior. ## Remediation 1. Never concatenate raw user input into HTML error responses. 2. If URL echo is required, HTML-escape it or force plain-text output. 3. Re-enable/strengthen CSP to reduce reflected injection impact.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2026-44651
More SillyTavern advisories
All SillyTavern| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 19 | SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl High8.5May 19 | High8.5 | 1.18.0 |
| May 12 | SillyTavern has a SSRF vulnerability in the CORS proxy middlewareMediumMay 12 | Medium | 1.18.0 |
| May 12 | SillyTavern has a Path Traversal issueCritical9.1May 12 | Critical9.1 | 1.18.0 |
| May 12 | SillyTavern has Authentication Bypass via SSO Header InjectionCritical9.8May 12 | Critical9.8 | 1.18.0 |
| May 12 | SillyTavern: insufficient session expirationHigh7.5May 12 | High7.5 | 1.18.0 |
| Apr 1 | SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6Medium5.0Apr 1 | Medium5.0 | 1.17.0 |