oobabooga text-generation-webui Remote Code Execution Vulnerability via Untrusted Input

A remote code execution vulnerability has been identified in oobabooga text-generation-webui. This issue arises from the improper validation of the trust_remote_code parameter in the join endpoint, allowing remote attackers to execute arbitrary code on the affected system. The executed code runs in the context of the service account. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the service account's privileges.

Remediation

oobabooga has released a patch for this vulnerability. Users should update to the latest version of text-generation-webui. Details about the update can be found in the project's GitHub repository.