Oobabooga vulnerabilities
We track 5 vulnerabilities in Oobabooga products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 7, 2026.
Latest Oobabooga vulnerabilities
- 7.5 High severity
text-generation-webui: Server-Side Request Forgery
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostnam
- 7.5 High severity
text-generation-webui: Improper Limitation of a Pathname to a Restricted Directory
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does
- 8.8 High severity
text-generation-webui: Improper Limitation of a Pathname to a Restricted Directory
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py"
- 9.8 Critical severity
text-generation-webui: Reliance on Untrusted Inputs in a Security Decision
oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authenticatio
- 9.8 Critical severity
text-generation-webui: Reliance on Untrusted Inputs in a Security Decision
oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authenticatio