Remote Code Execution Vulnerability in oobabooga Text-Generation-WebUI
CVE-2025-12488

9.8CRITICAL

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
6 November 2025

What is CVE-2025-12488?

The oobabooga text-generation-webui has a vulnerability in the trust_remote_code parameter used during the load endpoint process. This flaw allows remote attackers to execute arbitrary code without any form of authentication, as the validation of the user-supplied input is inadequate. By manipulating this parameter, attackers can load malicious models, potentially compromising the service account and its operations.

Affected Version(s)

text-generation-webui 2.5

References

https://www.zerodayinitiative.com/advisories/ZDI-25-981/
x_research-advisory
https://github.com/oobabooga/text-generation-webui/commit...
vendor-advisory

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-12488 : Remote Code Execution Vulnerability in oobabooga Text-Generation-WebUI