Vulnerability history

NPM: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

NPM: SillyTavern has a SSRF vulnerability in the CORS proxy middleware

NPM: SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware

NPM: SillyTavern has a Path Traversal issue

NPM: SillyTavern has Authentication Bypass via SSO Header Injection

NPM: SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

NPM: SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6

NPM: SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root

NPM: SillyTavern: Path Traversal allows file existence oracle

NPM: SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

NPM: SillyTavern Web Interface Vulnerable DNS Rebinding