SillyTavern remote access security checklist: 11 CVEs in 2026, the Node Brotli fix (CVE-2026-111497), 6 config.yaml keys

说明与用途

SillyTavern 远程访问安全检查清单：升级到 1.18.0，启用白名单，并为 CVE‑2026‑111497 修补 Node.js。

问题

SillyTavern users running the self‑hosted LLM chat frontend with remote access are exposed to multiple CVEs, including a critical Node.js Brotli vulnerability (CVE‑2026‑111497) and six SillyTavern‑specific CVEs that remain unpatched in older releases.

结果

By following the checklist, operators can ensure their SillyTavern deployment is free from the 11 CVEs identified in 2026 and the Node.js Brotli RCE, reducing exposure to remote code execution and other attacks.

工作流

• 1. Verify SillyTavern version (e.g., sillytavern --version).
• 2. Check Node.js patch level (node -v and node -p "require('zlib').BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH").
• 3. Ensure privateAddressWhitelist is set in config.yaml or enable basic auth / user accounts.
• 4. Restart SillyTavern and confirm the warning line disappears and no Blocked connection from entries appear.
• 5. Verify Docker image uses patched Node (check NODE_VERSION in image metadata).

证据

If you use SillyTavern from your phone or another PC, check three things now: the SillyTavern version, whether your Node.js has the 2026-10-21 security patch, and privateAddressWhitelist in config.yaml.

来源

The Node bug, CVE-2026-111497, went onto CISA's list of actively exploited vulnerabilities on 2026-10-27, and the official Docker image latest still ships an unpatched Node as of 2026-10-28.

来源

All 11 SillyTavern CVEs of 2026 are fixed in 1.18.0

来源

Node.js fixed CVE-2026-111497 in its 2026-10-21 security release and rated it High.

来源