8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46372

CVE-2026-46372: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body. This vulnerability is fixed in 1.18.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46372

CVE-2026-46372:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sillytavern	npm	<= 1.17.0	1.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Server-Side Request Forgery (SSRF) located in the /api/search/searxng endpoint, specifically within the anonymous function that handles POST requests. The root cause is the lack of validation on the baseUrl parameter, which is taken directly from the user-controlled request body and used to make server-side fetch calls. This allows an authenticated attacker to force the server to make requests to arbitrary URLs, including internal network services and loopback interfaces, thereby mapping internal networks or interacting with sensitive internal endpoints.

The patch addresses this vulnerability not by altering the individual vulnerable endpoint, but by implementing a comprehensive, application-wide defense mechanism. It introduces a new module, private-request-filter.js, which defines a custom PrivateRequestAgent. This agent is installed as the global agent for all http and https requests made by the Node.js application. The connect method of this agent intercepts every outgoing request, resolves the destination hostname to an IP address, and checks it against a list of private IP ranges. If a request targets a private IP that is not on an explicit whitelist, the agent blocks the request. This global filter effectively mitigates the SSRF vulnerability in /api/search/searxng and protects against similar vulnerabilities in other parts of the application.

Vulnerable functions

router.post('/searxng')

src/endpoints/search.js

This function handles POST requests to the `/api/search/searxng` endpoint. It extracts the `baseUrl` from the request body and uses it to construct URLs for server-side `fetch` requests. There is no validation to prevent `baseUrl` from being an internal or loopback address, leading to a Server-Side Request Forgery (SSRF) vulnerability. An attacker can exploit this to make the server send requests to internal services.

PrivateRequestAgent.connect

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.