CVE-2025-12487: Text-Generation-WebUI RCE Vulnerability

CVE-2025-12487 Overview

CVE-2025-12487 is a critical remote code execution vulnerability in oobabooga text-generation-webui, a popular open-source web interface for running large language models. This vulnerability allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The flaw exists within the handling of the trust_remote_code parameter provided to the join endpoint, where the lack of proper validation of user-supplied arguments before loading a model creates a dangerous attack surface.

Critical Impact

Unauthenticated remote attackers can achieve full code execution in the context of the service account, potentially leading to complete system compromise of servers running text-generation-webui.

Affected Products

• oobabooga text-generation-webui (versions prior to the security patch)
• Installations with the join endpoint accessible to untrusted users
• Deployments exposing the web interface without additional access controls

Discovery Timeline

• 2025-11-06 - CVE-2025-12487 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-12487

Vulnerability Analysis

This vulnerability is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The text-generation-webui application accepts user-controlled input through the trust_remote_code parameter at the join endpoint. When this parameter is enabled, the application allows the execution of arbitrary Python code that may be bundled with a model from remote repositories like Hugging Face. The fundamental issue is that the application permits this security-sensitive setting to be modified via the UI or API, rather than restricting it to command-line configuration only.

The vulnerability is network-accessible without authentication, requires no user interaction, and results in high impact to confidentiality, integrity, and availability of the affected system. An attacker can leverage this flaw to execute code within the context of the service account running the text-generation-webui process.

Root Cause

The root cause lies in the application's failure to make the --trust-remote-code flag immutable from the UI and API. Prior to the patch, the trust_remote_code parameter was included in the list of configurable loader options for various model loaders, allowing any user with access to the web interface to enable this dangerous setting. This architectural flaw violates the principle of least privilege by exposing a security-critical configuration option through untrusted input channels.

Attack Vector

An attacker can exploit this vulnerability by:

1. Accessing the text-generation-webui join endpoint remotely
2. Submitting a request that sets the trust_remote_code parameter to true
3. Loading a malicious model that contains arbitrary Python code
4. Achieving code execution when the application loads the model with remote code enabled

The attack requires no authentication, making any publicly accessible or internally reachable text-generation-webui instance vulnerable.

# Security patch in modules/loaders.py - Make --trust-remote-code immutable from the UI/API
         'disk',
         'use_double_quant',
         'bf16',
-        'trust_remote_code',
         'no_use_fast',
     ],
     'ExLlamav3_HF': [
         'ctx_size',
         'cache_type',
         'gpu_split',
         'cfg_cache',
-        'trust_remote_code',
         'no_use_fast',
         'enable_tp',
         'tp_backend',

Source: GitHub Commit Update

The patch removes trust_remote_code from the configurable options in various loader configurations, preventing users from enabling this setting through the web interface or API.

# Security patch in modules/shared.py - Make --trust-remote-code immutable from the UI/API
 
 
args = parser.parse_args()
+original_args = copy.deepcopy(args)
args_defaults = parser.parse_args([])
 
# Create a mapping of all argument aliases to their canonical names

Source: GitHub Commit Update

This portion of the patch preserves the original command-line arguments, ensuring that security-sensitive settings like trust_remote_code can only be set at application startup and cannot be modified at runtime.

Detection Methods for CVE-2025-12487

Indicators of Compromise

• Unexpected model loading activity with trust_remote_code enabled in application logs
• Unusual outbound network connections from the text-generation-webui process
• Process spawning or file system modifications by the service account running text-generation-webui
• API requests to the join endpoint containing the trust_remote_code parameter

Detection Strategies

• Monitor web application logs for requests containing trust_remote_code=true or similar parameters
• Implement network segmentation to detect unexpected communication from AI/ML inference servers
• Deploy endpoint detection solutions to identify code execution originating from the Python process
• Review Hugging Face model download logs for models from untrusted or suspicious repositories

Monitoring Recommendations

• Enable verbose logging for the text-generation-webui application to capture all API requests
• Set up alerts for process creation events under the text-generation-webui service account
• Monitor file integrity on systems running text-generation-webui deployments
• Implement network monitoring to detect connections to known malicious model repositories

How to Mitigate CVE-2025-12487

Immediate Actions Required

• Update text-generation-webui to the latest version containing commit b5a6904c4ac4049823396090360b6f566f4e4603
• Restrict network access to text-generation-webui instances using firewall rules or reverse proxy authentication
• Review application logs for any signs of exploitation attempts
• Audit any models loaded with trust_remote_code enabled for malicious content

Patch Information

The vulnerability has been addressed in a security patch available via the GitHub commit. The fix makes the --trust-remote-code flag immutable from the UI and API, ensuring this security-sensitive setting can only be configured at application startup via command-line arguments. Additional details are available in the Zero Day Initiative Advisory ZDI-25-982.

Workarounds

• Deploy text-generation-webui behind a reverse proxy with authentication requirements
• Use network segmentation to isolate AI/ML inference servers from untrusted networks
• If trust_remote_code functionality is not required, ensure the flag is never passed at startup
• Implement strict access controls limiting which users can interact with the web interface

# Configuration example - Running text-generation-webui with restricted access
# Use a reverse proxy (nginx) to add authentication
server {
    listen 443 ssl;
    server_name llm.internal.example.com;
    
    # Require authentication for all requests
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    location / {
        proxy_pass http://127.0.0.1:7860;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}