Homepage

sillytavern@1.16.0

LLM Frontend for Power Users

  • latest version

    1.17.0

  • latest non vulnerable version

    1.17.0

  • first published

    2 years ago

  • latest version published

    10 days ago

  • licenses detected

  • View sillytavern package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the sillytavern package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Directory Traversal

    sillytavern is a LLM Frontend for Power Users

    Affected versions of this package are vulnerable to Directory Traversal via the createRouteHandler function. An attacker can determine the existence of arbitrary files on the server's filesystem by sending specially crafted requests containing percent-encoded directory traversal sequences, which result in different HTTP status codes depending on whether the file exists.

    How to fix Directory Traversal?

    Upgrade sillytavern to version 1.17.0 or higher.

    <1.17.0
    • H
    External Control of File Name or Path

    sillytavern is a LLM Frontend for Power Users

    Affected versions of this package are vulnerable to External Control of File Name or Path via the /api/chats/import endpoint when unsanitized input in the character_name parameter is used to construct file paths. An attacker can write arbitrary files outside the intended directory by supplying crafted traversal sequences.

    How to fix External Control of File Name or Path?

    Upgrade sillytavern to version 1.17.0 or higher.

    <1.17.0
    • H
    Directory Traversal

    sillytavern is a LLM Frontend for Power Users

    Affected versions of this package are vulnerable to Directory Traversal via the avatar_url parameter in the chat export and delete endpoints. An attacker can read or delete arbitrary files within the user data root by supplying directory traversal sequences, potentially exposing sensitive information or disrupting account operation by removing critical files. This is only exploitable if the attacker is authenticated and possesses a valid session and CSRF token.

    How to fix Directory Traversal?

    Upgrade sillytavern to version 1.17.0 or higher.

    <1.17.0
    • M
    Server-side Request Forgery (SSRF)

    sillytavern is a LLM Frontend for Power Users

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the visit endpoint of the /api/search process. An attacker can access internal network resources and retrieve their responses by submitting specially crafted URLs containing hostnames or IPv6 addresses that bypass IP validation. This is only exploitable if the attacker is authenticated or CSRF protection is disabled.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade sillytavern to version 1.17.0 or higher.

    <1.17.0
    Go back to all versions of this package