https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:44:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323410 EUVD-2026-323410 https://cve.radiocsirt.org/vuln/euvd-2026-323410 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44651 <p>SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send(&#39;Error occurred while trying to proxy to: &#39; + url + &#39; &#39; + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.</p> <p>SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send(&#39;Error occurred while trying to proxy to: &#39; + url + &#39; &#39; + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering. This vulnerability is fixed in 1.18.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44651 https://cve.radiocsirt.org/vuln/ghsa-xc4x-2452-5gc9 <p><strong>Affected:</strong> npm: sillytavern</p> <p>## Resolution</p> <p>Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.</p> <p>## Overview - Vulnerability Type: XSS - Affected Location: `src/middleware/corsProxy.js:40` - Trigger Scenario: reflected XSS in CORS proxy error response</p> <p>## Root Cause When `fetch(url)` throws, the code sends: `res.status(500).send(&#39;Error occurred while trying to proxy to: &#39; + url + &#39; &#39; + error)`. The `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering.</p> <p>## Source-to-Sink Chain 1. Source (user-controlled input) - Entry point: `GET /proxy/:url(*)`</p> <p>2. Data flow - Code analysis shows concrete propagation into this sink: - vulnerability title: `Reflected XSS in CORS proxy error response` - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40` - The same sink behavior is confirmed by controlled execution observations.</p> <p>3. Sink (dangerous operation) - Sink location: `src/middleware/corsProxy.js:40` - Vulnerable behavior: reflected XSS in CORS proxy error response</p> <p>## Exploitation Preconditions 1. The attacker can inject controllable content into a rendered response. 2. The vulnerable rendering context does not apply strict output encoding/sanitization. 3. A victim user opens the affected page or response.</p> <p>## Risk This issue enables script execution in the victim context and can compromise session or data integrity.</p> <p>## Impact An attacker may run arbitrary JavaScript in the victim context…</p> <p><strong>Affected:</strong> npm: sillytavern</p> <p>## Resolution</p> <p>Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.</p> <p>## Overview - Vulnerability Type: XSS - Affected Location: `src/middleware/corsProxy.js:40` - Trigger Scenario: reflected XSS in CORS proxy error response</p> <p>## Root Cause When `fetch(url)` throws, the code sends: `res.status(500).send(&#39;Error occurred while trying to proxy to: &#39; + url + &#39; &#39; + error)`. The `url` value is attacker-controlled (`req.params.url`) and is not HTML-escaped before rendering.</p> <p>## Source-to-Sink Chain 1. Source (user-controlled input) - Entry point: `GET /proxy/:url(*)`</p> <p>2. Data flow - Code analysis shows concrete propagation into this sink: - vulnerability title: `Reflected XSS in CORS proxy error response` - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:40` - The same sink behavior is confirmed by controlled execution observations.</p> <p>3. Sink (dangerous operation) - Sink location: `src/middleware/corsProxy.js:40` - Vulnerable behavior: reflected XSS in CORS proxy error response</p> <p>## Exploitation Preconditions 1. The attacker can inject controllable content into a rendered response. 2. The vulnerable rendering context does not apply strict output encoding/sanitization. 3. A victim user opens the affected page or response.</p> <p>## Risk This issue enables script execution in the victim context and can compromise session or data integrity.</p> <p>## Impact An attacker may run arbitrary JavaScript in the victim context…</p> https://cve.radiocsirt.org/vuln/ghsa-xc4x-2452-5gc9