{"data":{"id":"9d7b7fe3-1ab5-436a-aad5-770914c16175","title":"CVE-2026-26286: SillyTavern is a locally installed user interface that allows users to interact with text generation large language…","summary":"CVE-2026-26286 affects SillyTavern, a locally installed user interface for text generation LLMs, image generation engines, and text-to-speech models, in versions prior to 1.16.0. An authenticated user can abuse a Server-Side Request Forgery flaw in the asset download endpoint to make arbitrary HTTP requests from the server and read the full response body. This exposes internal services, cloud metadata, and private network resources.","solution":"Fixed in 1.16.0, which introduces a whitelist domain check for asset download requests. The whitelist can be reviewed and customized by editing the `whitelistImportDomains` array in the `config.yaml` file.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26286","publishedAt":"2026-02-19T21:18:31.670Z","cveId":"CVE-2026-26286","cweIds":["CWE-918"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["SillyTavern"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"SillyTavern server-side request forgery in asset download endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00317,"epssCheckedAt":"2026-11-04T12:08:34.493Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:32.439Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}