SillyTavern vulnerabilities
We track 8 vulnerabilities in SillyTavern products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on May 29, 2026.
Latest SillyTavern vulnerabilities
- 8.5 High severity
SillyTavern: Server-Side Request Forgery
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attac
- 9.1 Critical severity
SillyTavern: Improper Limitation of a Pathname to a Restricted Directory
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName:
- 9.8 Critical severity
SillyTavern: Authentication Bypass by Spoofing
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-U
- 7.5 High severity
SillyTavern is a locally installed user interface that allows users to interact with text…
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, sto
- 8.8 High severity
SillyTavern: Improper Limitation of a Pathname to a Restricted Directory
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints all
- 8.1 High severity
SillyTavern: Improper Limitation of a Pathname to a Restricted Directory
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import
- 8.5 High severity
SillyTavern: Server-Side Request Forgery
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerabili
- 9.6 Critical severity
SillyTavern: Origin Validation Error
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is suscep