CVE-2025-12488: oobabooga text-generation-webui RCE Flaw

CVE-2025-12488 Overview

CVE-2025-12488 is a critical remote code execution vulnerability affecting oobabooga text-generation-webui, a popular open-source web interface for running large language models. This vulnerability allows remote attackers to execute arbitrary code on affected installations without requiring authentication.

The specific flaw exists within the handling of the trust_remote_code parameter provided to the load endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account, potentially leading to complete system compromise.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on systems running vulnerable versions of text-generation-webui, potentially compromising the entire host and any AI models or data processed by the application.

Affected Products

• oobabooga text-generation-webui (versions prior to the security patch)
• Self-hosted LLM deployments using text-generation-webui
• AI/ML infrastructure environments running vulnerable instances

Discovery Timeline

• 2025-11-06 - CVE-2025-12488 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-12488

Vulnerability Analysis

This vulnerability is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The text-generation-webui application exposes a model loading endpoint that accepts a trust_remote_code parameter. This parameter, when enabled, allows the execution of arbitrary Python code bundled with HuggingFace models during the model loading process.

The vulnerability arises because the application fails to properly validate or restrict this user-controllable parameter before using it in security-critical operations. Remote attackers can craft malicious requests to the load endpoint, specifying a model repository containing embedded malicious code. When trust_remote_code is set to true, the application executes this code without proper sandboxing or validation.

The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous for publicly exposed or inadequately firewalled text-generation-webui instances.

Root Cause

The root cause stems from improper handling of the trust_remote_code parameter in the model loading functionality. The application directly uses untrusted user input to determine whether to execute potentially malicious code from external model repositories. This design flaw allows attackers to bypass security boundaries by controlling the trust decision for remote code execution during model initialization.

Attack Vector

The attack exploits the model loading mechanism in text-generation-webui through the following approach:

1. The attacker identifies a text-generation-webui instance accessible over the network
2. A malicious model repository is prepared containing embedded Python code in configuration files or custom model implementations
3. The attacker sends a request to the load endpoint specifying the malicious model and setting trust_remote_code=True
4. The application loads the model and executes the embedded malicious code with the privileges of the service account

This vulnerability was tracked by the Zero Day Initiative as ZDI-CAN-26680. The attack requires no authentication, and exploitation can be performed remotely over the network. For detailed technical information, refer to the Zero Day Initiative Advisory ZDI-25-981.

Detection Methods for CVE-2025-12488

Indicators of Compromise

• Unexpected model loading requests with trust_remote_code parameter set to true
• Network connections to unfamiliar or suspicious model repositories
• Anomalous process spawning from the text-generation-webui service account
• Unexpected file system modifications or new files created by the webui process

Detection Strategies

• Monitor HTTP/API requests to the model load endpoint for suspicious trust_remote_code parameters
• Implement network traffic analysis for connections to unknown or untrusted model hosting services
• Deploy endpoint detection to identify unusual child processes spawned by the Python interpreter running text-generation-webui
• Review application logs for model loading activity referencing external or untrusted repositories

Monitoring Recommendations

• Enable verbose logging for the text-generation-webui application to capture all model load requests
• Implement alerting on any model loading attempts from non-whitelisted sources
• Monitor system resource utilization for signs of cryptomining or other malicious activity following potential exploitation
• Deploy file integrity monitoring on directories where models are stored

How to Mitigate CVE-2025-12488

Immediate Actions Required

• Update text-generation-webui to the latest patched version immediately
• Restrict network access to text-generation-webui instances using firewall rules
• Review model loading logs for any suspicious activity that may indicate prior exploitation
• Consider disabling or restricting the trust_remote_code functionality at the application configuration level

Patch Information

A security patch addressing this vulnerability is available. The fix is implemented in commit b5a6904c4ac4049823396090360b6f566f4e4603. Users should update their installations by pulling the latest code from the official repository. For patch details, see the GitHub Commit Update.

Workarounds

• Disable public network access to text-generation-webui instances and restrict access to trusted internal networks only
• Implement network-level authentication (VPN, reverse proxy with authentication) before the application
• Configure firewall rules to limit access to the model loading endpoint
• Only load models from trusted, verified sources and avoid using trust_remote_code with untrusted repositories

# Example firewall rule to restrict access to text-generation-webui
# Allow only trusted IP ranges to access the webui port
iptables -A INPUT -p tcp --dport 7860 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7860 -j DROP