CVE-2025-12487: oobabooga text-generation-webui trust_remote_code RCE Vulnerability

## Vulnerability Key Information - **Vulnerability Name**: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability - **ZDI ID**: ZDI-25-982 - **ZDI-CAN ID**: ZDI-CAN-26681 - **CVE ID**: CVE-2025-12487 - **CVSS Score**: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - **Affected Vendor**: oobabooga - **Affected Product**: text-generation-webui ### Vulnerability Details - **Description**: This vulnerability allows remote attackers to execute arbitrary code on affected oobabooga text-generation-webui installations. Exploitation of this vulnerability does not require authentication. - **Specific Issue**: A specific flaw exists in the handling of the trust_remote_code parameter passed to the join endpoint. The issue stems from insufficient validation of user-supplied parameters before using them to load a model. Attackers can exploit this vulnerability to execute code in the context of the service account. ### Additional Details - **Patch**: oobabooga has released an update to fix this vulnerability. More information can be found in the [GitHub Commit](https://github.com/oobabooga/text-generation-webui/commit/b5a6904c4ac4049823396090360b6f566f4e4603). ### Disclosure Timeline - 2025-03-13: Vulnerability reported to vendor - 2025-10-30: Coordinated public advisory release - 2025-10-30: Advisory updated ### Acknowledgments - Nicholas Zubrisky (@NZubrisky) of Trend Micro Security Research

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-12487: oobabooga text-generation-webui trust_remote_code RCE Vulnerability