SillyTavern remote access security checklist: 11 CVEs in 2026, the Node Brotli fix (CVE-2026-111497), 6 config.yaml keys

Описание и применение

Проверка удалённого доступа к SillyTavern: обновление до версии 1.18.0, включение whitelist и патч Node.js для CVE‑2026‑111497.

Задача

SillyTavern users running the self‑hosted LLM chat frontend with remote access are exposed to multiple CVEs, including a critical Node.js Brotli vulnerability (CVE‑2026‑111497) and six SillyTavern‑specific CVEs that remain unpatched in older releases.

Результат

By following the checklist, operators can ensure their SillyTavern deployment is free from the 11 CVEs identified in 2026 and the Node.js Brotli RCE, reducing exposure to remote code execution and other attacks.

Рабочий процесс

• 1. Verify SillyTavern version (e.g., sillytavern --version).
• 2. Check Node.js patch level (node -v and node -p "require('zlib').BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH").
• 3. Ensure privateAddressWhitelist is set in config.yaml or enable basic auth / user accounts.
• 4. Restart SillyTavern and confirm the warning line disappears and no Blocked connection from entries appear.
• 5. Verify Docker image uses patched Node (check NODE_VERSION in image metadata).

Доказательства

If you use SillyTavern from your phone or another PC, check three things now: the SillyTavern version, whether your Node.js has the 2026-10-21 security patch, and privateAddressWhitelist in config.yaml.

Источник

The Node bug, CVE-2026-111497, went onto CISA's list of actively exploited vulnerabilities on 2026-10-27, and the official Docker image latest still ships an unpatched Node as of 2026-10-28.

Источник

All 11 SillyTavern CVEs of 2026 are fixed in 1.18.0

Источник

Node.js fixed CVE-2026-111497 in its 2026-10-21 security release and rated it High.

Источник