CVE-2025-12487

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-12487

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12487.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-12487

Published

2025-11-06T20:12:07.187Z

Modified

2026-07-08T08:10:19.759701044Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

Details

oobabooga text-generation-webui trustremotecode Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the trustremotecode parameter provided to the join endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26681.

Database specific

{
    "cna_assigner": "zdi",
    "cwe_ids": [
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12487.json"
}

References

Affected packages

Git / github.com/oobabooga/textgen

Affected ranges

Type

GIT

Repo

https://github.com/oobabooga/textgen

Events

Introduced

7c883ef2f06b1971e43184d087afe83646fd1b50

Fixed

b5a6904c4ac4049823396090360b6f566f4e4603

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.5"
        },
        {
            "last_affected": "2.5"
        }
    ]
}

Affected versions

2.*

2.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12487.json"