[GH-ISSUE #251] Potential Security Issue #155

New issue

Open

opened 2026-10-15 18:05:05 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-15 18:05:05 +00:00

Owner

Originally created by @LeaveerWang on GitHub (Feb 17, 2026).
Original GitHub issue: https://github.com/SillyTavern/SillyTavern-Extras/issues/251

Hi,

We have identified a potential security issue in this project, but the details have not yet been publicly disclosed.

We understand that this project has been archived; however, under responsible disclosure guidelines, we are still required to make a reasonable attempt to contact the maintainers.

We would like to collaborate with you on responsible disclosure. Could you please provide a preferred contact method for security reports? You may also reach us directly at hwang335@jh.edu.

Thank you.

Originally created by @LeaveerWang on GitHub (Feb 17, 2026). Original GitHub issue: https://github.com/SillyTavern/SillyTavern-Extras/issues/251 Hi, We have identified a potential security issue in this project, but the details have not yet been publicly disclosed. We understand that this project has been archived; however, under responsible disclosure guidelines, we are still required to make a reasonable attempt to contact the maintainers. We would like to collaborate with you on responsible disclosure. Could you please provide a preferred contact method for security reports? You may also reach us directly at hwang335@jh.edu. Thank you.

bsakaguchi commented

2026-10-15 18:05:06 +00:00

Author

Owner

@Cohee1207 commented on GitHub (Feb 17, 2026):

Enabled vulnerability disclosure on the repo. You're right that the project is abandoned and not recommended to install or use.

@Cohee1207 commented on GitHub (Feb 17, 2026): Enabled vulnerability disclosure on the repo. You're right that the project is abandoned and not recommended to install or use.

bsakaguchi commented

2026-10-15 18:05:06 +00:00

Author

Owner

@LeaveerWang commented on GitHub (Feb 17, 2026):

Hi @Cohee1207,

Thank you for the quick response and for enabling vulnerability disclosure on the repository.

At the moment, the Security tab still indicates that no SECURITY.md policy is configured, and we do not see a “Report a vulnerability” / private reporting entry point available for external researchers (the advisory submission link is currently inaccessible).

If you would like to review the technical details and PoC under responsible disclosure, please enable private vulnerability reporting and let us know once it is available, or feel free to contact us directly via email. We will be happy to provide the full report privately.

Best regards,
Haoyu Wang
hwang335@jh.edu

@LeaveerWang commented on GitHub (Feb 17, 2026): Hi @Cohee1207, Thank you for the quick response and for enabling vulnerability disclosure on the repository. At the moment, the Security tab still indicates that no SECURITY.md policy is configured, and we do not see a “Report a vulnerability” / private reporting entry point available for external researchers (the advisory submission link is currently inaccessible). If you would like to review the technical details and PoC under responsible disclosure, please enable private vulnerability reporting and let us know once it is available, or feel free to contact us directly via email. We will be happy to provide the full report privately. Best regards, Haoyu Wang hwang335@jh.edu

bsakaguchi commented

2026-10-15 18:05:06 +00:00

Author

Owner

@Cohee1207 commented on GitHub (Feb 17, 2026):

Try again; https://github.com/SillyTavern/SillyTavern-Extras/security/advisories

@Cohee1207 commented on GitHub (Feb 17, 2026): Try again; https://github.com/SillyTavern/SillyTavern-Extras/security/advisories

bsakaguchi commented

2026-10-15 18:05:06 +00:00

Author

Owner

@LeaveerWang commented on GitHub (Feb 18, 2026):

Hi @Cohee1207,

Thanks — the private vulnerability report has been successfully submitted via the Security Advisory page.

Please let us know if you need any additional reproduction steps, PoC, or any further details.

Best regards,
Haoyu Wang

@LeaveerWang commented on GitHub (Feb 18, 2026): Hi @Cohee1207, Thanks — the private vulnerability report has been successfully submitted via the Security Advisory page. Please let us know if you need any additional reproduction steps, PoC, or any further details. Best regards, Haoyu Wang

bsakaguchi referenced this issue

2026-10-15 18:05:39 +00:00

[PR #155] [MERGED] Normalize initial.png paths #154 #219