Remote Code Execution Vulnerability in oobabooga Text Generation Web UI
CVE-2025-12487

9.8CRITICAL

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
6 November 2025

What is CVE-2025-12487?

A vulnerability in the oobabooga text-generation-webui application enables remote attackers to execute arbitrary code. This issue arises from inadequate validation in the handling of the 'trust_remote_code' parameter within the join endpoint, allowing an attacker to exploit the gap without authentication. By providing a malicious argument, an attacker could trigger the execution of code in the context of the service account, significantly compromising the security of affected installations.

Affected Version(s)

text-generation-webui 2.5

References

https://www.zerodayinitiative.com/advisories/ZDI-25-982/
x_research-advisory
https://github.com/oobabooga/text-generation-webui/commit...
vendor-advisory

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-12487 : Remote Code Execution Vulnerability in oobabooga Text Generation Web UI