Read the docs
TI-2025-36763 Aliases CVE-2025-59159GHSA-7cxj-w27x-x78q

SillyTavern Web Interface Vulnerable to DNS Rebinding

Priority HIGH 76CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing attacks, etc. The vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable. While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed SillyTavern (SillyTavern): 1.13.4sillytavern (npm): 1.13.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SillyTavernSillyTavernbefore 1.13.41.13.4Patch availableCNA
—sillytavern (npm)before 1.13.41.13.4Patch availableGHSA-7cxj-w27x-x78q
  • SillyTavern VendorSillyTavern Affected before 1.13.4 Fixed in 1.13.4 Patch available CNA
  • sillytavern (npm) Vendor— Affected before 1.13.4 Fixed in 1.13.4 Patch available GHSA-7cxj-w27x-x78q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:*:*:*——SillyTavern
  • cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:*:*:* Versions — — ·SillyTavern

Remediation

  • Fix · CNA SillyTavern (SillyTavern) Fixed in 1.13.4
  • Fix · GHSA-7cxj-w27x-x78q sillytavern (npm) Fixed in 1.13.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59159
  2. 2026-10-03 Alias added: GHSA-7cxj-w27x-x78q

References

Advisory 1

Other 6

  • TI-2026-32549 SillyTavern: Authentication Bypass via SSO Header Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-32550 SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS 3.1CRITICAL 9.1
  • TI-2026-26773 Path traversal in SillyTavern CVSS 3.1HIGH 8.8
  • TI-2026-34089 SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl CVSS 3.1HIGH 8.5
  • TI-2026-70544 Pre-authentication denial of service in SillyTavern via body parsing CVSS 4.0HIGH 8.2
  • TI-2026-32548 SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences