CVE-2025-12487
oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability
- State
- Published
- Severity
- 9.8 Critical
- Published
- Nov 6, 2025
- Updated
- Nov 6, 2025
- Reserved
- Oct 29, 2025
Description
oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the trust_remote_code parameter provided to the join endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26681.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | zdi |
Weaknesses
- CWE-807 Reliance on Untrusted Inputs in a Security Decision
Affected Products
| Product | Versions |
|---|---|
text-generation-webuioobabooga |
|
References
- ZDI-25-982
- vendor-provided URLvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.