Code Execution Vulnerability in Text-Generation-WebUI by Oobabooga
CVE-2026-35050

9.1CRITICAL

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
6 April 2026

What is CVE-2026-35050?

The text-generation-webui, an open-source web interface for Large Language Models, has a vulnerability that allows users to save extension settings in a 'py' format located in the application’s root directory. Versions prior to 4.1.1 are susceptible, as this flaw enables overwriting of critical Python files, such as 'download-model.py'. If exploited, this could lead to the unauthorized execution of malicious code when users initiate a model download from the Model menu. This issue has been resolved in version 4.1.1, and users are strongly encouraged to upgrade to mitigate potential risks.

Affected Version(s)

text-generation-webui < 4.1.1

References

https://github.com/oobabooga/text-generation-webui/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.