Description
Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.
Recommendation
Update the sillytavern package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.17.0
- Patched version(s): 1.18.0
References
Could your website be exposed too?
SmartScanner can check your website for SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SillyTavern has a SSRF vulnerability in the CORS proxy middleware - CVE-2026-44652
- NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
- Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
- Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026