CVE-2026-35486

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35486
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35486.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35486
Aliases
  • GHSA-jvrj-w5hq-6cp2
Published
2026-04-07T14:49:37Z
Modified
2026-09-04T03:45:41Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation
Details

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access cloud metadata endpoints, steal IAM credentials, and probe internal services. The fetched content is exfiltrated through the RAG pipeline. This vulnerability is fixed in 4.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35486.json"
}
References

Affected packages

Git / github.com/oobabooga/textgen

Affected ranges

Type
GIT
Repo
https://github.com/oobabooga/textgen
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9374a4e70d4e3d26ddda30e5493ad8a7b1d75122
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:oobabooga:text_generation_web_ui:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.6.1
Other
installers
snapshot-2023-10-22
snapshot-2023-10-29
snapshot-2023-11-05
snapshot-2023-11-12
snapshot-2023-11-19
snapshot-2023-11-26
snapshot-2023-12-03
snapshot-2023-12-10
snapshot-2023-12-17
snapshot-2023-12-24
snapshot-2023-12-31
snapshot-2024-01-07
snapshot-2024-01-14
snapshot-2024-01-21
snapshot-2024-01-28
snapshot-2024-02-04
snapshot-2024-02-11
snapshot-2024-02-18
snapshot-2024-02-25
snapshot-2024-03-03
snapshot-2024-03-10
snapshot-2024-03-17
snapshot-2024-03-24
snapshot-2024-03-31
snapshot-2024-04-07
snapshot-2024-04-14
snapshot-2024-04-21
snapshot-2024-04-28
v1.*
v1.0
v1.1
v1.10
v1.10.1
v1.11
v1.12
v1.13
v1.14
v1.15
v1.16
v1.4
v1.5
v1.6
v1.7
v1.8
v1.9
v1.9.1
v2.*
v2.0
v2.1
v2.2
v2.3
v2.4
v2.5
v2.6
v2.7
v2.8
v2.8.1
v3.*
v3.0
v3.1
v3.10
v3.11
v3.12
v3.13
v3.14
v3.15
v3.16
v3.17
v3.18
v3.19
v3.2
v3.20
v3.21
v3.22
v3.23
v3.3
v3.3.1
v3.3.2
v3.4
v3.4.1
v3.5
v3.6
v3.6.1
v3.7
v3.7.1
v3.8
v3.9
v3.9.1
v4.*
v4.0
v4.1
v4.1.1
v4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35486.json"