SillyTavern EUVD-2026-96340

The attacker only needs network reachability to a SillyTavern instance running 1.12.13 through 1.19.0; no authentication and no special feature toggle is required because the body-parser middleware parses request bodies (JSON or urlencoded, up to the 500 MB limit, including compressed payloads) BEFORE authentication and whitelist/IP checks are applied, so default configurations are affected. The key limiting factor is exposure: SillyTavern is normally run as a local single-user service bound to localhost or a trusted LAN, so realistic exploitation requires that the operator has deliberately exposed the instance to untrusted networks (or disabled/weakened its listen-address/whitelist restrictions). Effective resource exhaustion may also require sending sufficiently large or decompression-heavy bodies and/or multiple parallel connections.

The vendor CVSS 4.0 vector (AV:N/PR:N/UI:N) marks this as a network-reachable, unauthenticated flaw, which is the primary risk driver: the body-parser middleware runs before authentication and whitelist checks, so no credentials are needed. However, impact is strictly availability (VC:N/VI:N/VA:H) - there is no data disclosure or code execution, so this is a pure denial-of-service issue. The vendor also assigned AC:H/AT:P, indicating some attack preconditions/complexity, which moderates the otherwise-high 8.2 score. Exploit code is publicly available (reported by VulnCheck with a HackMD writeup), raising the practical likelihood of opportunistic abuse, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - treat POC availability and active exploitation as distinct signals. The most important mitigating real-world factor not reflected in the CVSS score is deployment reality: SillyTavern is a self-hosted LLM chat frontend typically bound to localhost or a LAN, so the AV:N 'network' vector only translates to real exposure for instances deliberately published to the internet. Net assessment: a genuine, easily-triggered DoS for internet-exposed SillyTavern instances, but a low concern for the common localhost/LAN deployment; prioritize patching only where the instance is externally reachable.

An attacker who can reach a SillyTavern instance (version 1.12.13-1.19.0) over the network sends one or more HTTP requests carrying a very large or highly compressed JSON/urlencoded body (up to 500 MB) to any endpoint; because body-parser runs before authentication, the server buffers and parses the payload, consuming memory and CPU. By issuing such requests in parallel the attacker exhausts server resources and makes the application unresponsive to legitimate users. Public exploit/POC material exists (VulnCheck advisory and a HackMD writeup), lowering the barrier to reproduction.