EUVD-2026-33405
GHSA-xc4x-2452-5gc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires victim browser interaction (UI:R) and changes execution scope to the victim's context (S:C); no privileges or special configuration needed to reach the proxy endpoint.
Primary rating from Vendor (https://github.com/SillyTavern/SillyTavern).
CVSS VectorVendor: https://github.com/SillyTavern/SillyTavern
Lifecycle Timeline
4DescriptionCVE.org
Resolution
Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.
Overview
- Vulnerability Type: XSS
- Affected Location:
src/middleware/corsProxy.js:40 - Trigger Scenario: reflected XSS in CORS proxy error response
Root Cause
When fetch(url) throws, the code sends: res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). The url value is attacker-controlled (req.params.url) and is not HTML-escaped before rendering.
Source-to-Sink Chain
- Source (user-controlled input)
- Entry point:
GET /proxy/:url(*)
- Data flow
- Code analysis shows concrete propagation into this sink:
- vulnerability title:
Reflected XSS in CORS proxy error response - sink location reached by attacker-controlled input:
src/middleware/corsProxy.js:40 - The same sink behavior is confirmed by controlled execution observations.
- Sink (dangerous operation)
- Sink location:
src/middleware/corsProxy.js:40 - Vulnerable behavior: reflected XSS in CORS proxy error response
Exploitation Preconditions
- The attacker can inject controllable content into a rendered response.
- The vulnerable rendering context does not apply strict output encoding/sanitization.
- A victim user opens the affected page or response.
Risk
This issue enables script execution in the victim context and can compromise session or data integrity.
Impact
An attacker may run arbitrary JavaScript in the victim context, steal tokens, and manipulate user-visible behavior.
Remediation
- Never concatenate raw user input into HTML error responses.
- If URL echo is required, HTML-escape it or force plain-text output.
- Re-enable/strengthen CSP to reduce reflected injection impact.
AnalysisAI
Reflected XSS in SillyTavern's CORS proxy middleware (all versions prior to 1.18.0) allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that triggers the server's unescaped HTTP 500 error response. The server concatenates the raw attacker-controlled URL parameter directly into the response body at src/middleware/corsProxy.js:40 without HTML encoding, enabling token theft and session manipulation against any user who loads a crafted proxy link. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.05% (15th percentile), indicating low real-world exploitation activity; a vendor patch is available in version 1.18.0.
Technical ContextAI
SillyTavern is a self-hosted Node.js AI character roleplay frontend distributed as the npm package sillytavern (CPE: pkg:npm/sillytavern). It includes a built-in CORS proxy so the browser can reach external AI backends without cross-origin restrictions. The proxy is exposed via the route GET /proxy/:url(*), where the URL segment is taken directly from req.params.url and passed to Node.js fetch(). When fetch() throws - as it will for any malformed or unreachable URL - the exception handler at corsProxy.js:40 constructs its 500 response via raw string concatenation: res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + error). No HTML encoding is applied before writing to the response body. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) flaw: the attacker-controlled url value flows from the route parameter source directly into the HTML sink with no sanitization, allowing injection of arbitrary script tags or event handlers that execute in the victim's browser context.
RemediationAI
The primary fix is to upgrade SillyTavern to version 1.18.0 or later, in which the user-provided URL is no longer reflected in the HTTP response body. The patch is confirmed by GitHub Security Advisory GHSA-xc4x-2452-5gc9 and available at https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0. If an immediate upgrade is not feasible, the most effective compensating control is to restrict network access to the /proxy/ endpoint so that only localhost or explicitly trusted users can reach it - SillyTavern 1.18.0 also introduces IP whitelisting and rate limiting features that reduce attack surface more broadly, giving additional incentive to upgrade. Enforcing a strict Content Security Policy (CSP) on the server is a viable defense-in-depth measure that would limit the impact of any remaining reflected injection, but it does not eliminate the vulnerability and carries a trade-off of potentially breaking legitimate frontend functionality if CSP directives are misconfigured. There is no code-level workaround short of patching or removing the CORS proxy endpoint entirely.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today