Detections
Analytics

SCA: security update for sillytavern (GHSA-7cxj-w27x-x78q)

critical Tenable Cloud Security Plugin ID 435519

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - SillyTavern is a locally installed user interface that allows users to interact with text generation large
 language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4,
 the web user interface for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform
 actions like install malicious extensions, read chats, inject arbitrary HTML for phishing attacks, etc.
 The vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting
 that enables a validation of host names in inbound HTTP requests according to the provided list of allowed
 hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment
 variable. While the setting is disabled by default to honor a wide variety of existing user configurations
 and maintain backwards compatibility, existing and new users are encouraged to review their server
 configurations and apply necessary changes to their setup, especially if hosting over the local network
 while not using SSL. (CVE-2025-59159)

See Also

https://github.com/advisories/GHSA-7cxj-w27x-x78q

Plugin Details

Severity: Critical

ID: 435519

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 10/7/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-59159

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/6/2025

Vulnerability Publication Date: 10/6/2025

Reference Information

CVE: CVE-2025-59159