SillyTavern Reflected Cross-Site Scripting Vulnerability in CORS Proxy Error Response

A reflected cross-site scripting vulnerability has been identified in SillyTavern versions prior to 1.18.0. This issue arises in the CORS proxy middleware, where an attacker can inject malicious scripts through the 'url' parameter. When the 'fetch' function fails, the error response includes the unescaped URL, creating an opportunity for script execution in the context of the user.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the user's context, potentially leading to the theft of tokens and manipulation of user-visible behavior.

Remediation

Users are advised to update to SillyTavern version 1.18.0 or later. In addition, avoid including raw user input in HTML error responses without proper sanitization. If it is necessary to echo URLs, ensure they are HTML-escaped or output as plain text. Reinforcing the Content Security Policy can also help mitigate the impact of such reflected injections.