Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2025-59159 β€” AI Deep Analysis Summary

CVSS 9.7 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SillyTavern < 1.13.4 suffers from **DNS Rebinding** (CWE-346).…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: **CWE-346** (General Test for DNS Rebinding).…

Q3Who is affected? (Versions/Components)

πŸ‘₯ **Affected**: Users running **SillyTavern versions prior to 1.13.4**. πŸ“¦ Specifically the open-source LLM frontend interface. πŸ“… **Published**: Oct 6, 2025. ⚠️ If you haven't updated since then, you are vulnerable!

Q4What can hackers do? (Privileges/Data)

πŸ’€ **Attacker Capabilities**: 1. πŸ“¦ Install **Malicious Extensions** (full control). 2. πŸ“– **Read Chat History** (privacy leak). 3. 🎣 **Inject Arbitrary HTML** (phishing/traps). 4.…

Q5Is exploitation threshold high? (Auth/Config)

πŸ”“ **Exploitation Threshold**: **Low/Medium**. - **Auth**: PR:N (No Privileges Required). - **UI**: UI:R (User Interaction Required - you must visit a malicious link/page).…

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ§ͺ **Public Exploit**: **No PoC provided** in the data. 🚫 The `pocs` array is empty. However, DNS Rebinding is a well-known technique, so theoretical exploits exist.…

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: 1. πŸ“‹ Check your SillyTavern version in settings. 2. 🚫 Is it **< 1.13.4**? If yes, you are vulnerable. 3. 🌐 Review if you have clicked suspicious links while using the app. 4.…

Q8Is it fixed officially? (Patch/Mitigation)

βœ… **Official Fix**: **YES**. πŸ› οΈ Fixed in **Version 1.13.4**. πŸ“₯ Update immediately via GitHub releases.…

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. 🚫 **Disable Extensions** completely until updated. 2. πŸ›‘οΈ Use **Host Whitelisting** in config.yaml (see docs). πŸ“ This restricts which domains the frontend can talk to. 3.…

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: **HIGH** (CVSS 8.8 - High). 🚨 **Priority**: Patch Immediately. πŸƒβ€β™‚οΈ Since it requires no auth and allows data theft/malware, treat this as a critical security update. πŸ›‘οΈ Don't wait! Update to 1.13.4+ NOW.…