CVE-2026-34526

Name of the Vulnerable Software and Affected Versions SillyTavern versions prior to 1.17.0

Description SillyTavern is a locally installed user interface for interacting with text generation large language models, image generation engines, and text-to-speech voice models. A Server-Side Request Forgery (SSRF) issue exists in the src/endpoints/search.js file. The application uses a regular expression that only validates literal dotted-quad IPv4 addresses, failing to block localhost, IPv6 loopback addresses like [::1], and DNS names that resolve to internal addresses. Exploitation is limited to services running on default ports 80 and 443 due to a port check on the urlObj.port variable.

Recommendations Update to version 1.17.0.