CVE-2026-26286

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26286
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26286.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26286
Aliases
  • GHSA-cccp-94vg-j92r
Published
2026-02-19T21:02:22.470Z
Modified
2026-04-10T05:36:57.957463Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services
Details

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerability in the asset download endpoint allows authenticated users to make arbitrary HTTP requests from the server and read the full response body, enabling access to internal services, cloud metadata, and private network resources. The vulnerability has been patched in the version 1.16.0 by introducing a whitelist domain check for asset download requests. It can be reviewed and customized by editing the whitelistImportDomains array in the config.yaml file.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26286.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/sillytavern/sillytavern

Affected ranges

Type
GIT
Repo
https://github.com/sillytavern/sillytavern
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3b866b5d2bcc7fbaa889bb926fbb567cd1ed25b

Affected versions

1.*
1.10.0
1.10.1
1.10.10
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.10.8
1.10.9
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.4-1
1.11.5
1.11.6
1.11.7
1.11.8
1.12.0
1.12.0-6
1.12.1
1.12.10
1.12.11
1.12.12
1.12.13
1.12.14
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.15.0
1.9.2
1.9.5
1.9.6
1.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26286.json"