oobabooga text-generation-webui Remote Code Execution Vulnerability via Untrusted Inputs

A remote code execution vulnerability has been identified in oobabooga text-generation-webui. This issue arises from the improper validation of the trust_remote_code parameter in the load endpoint, allowing remote attackers to execute arbitrary code on the affected system. The vulnerability can be exploited without authentication, with the executed code running under the service account's context.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

oobabooga has released a patch for this vulnerability. Users should update to the latest version of text-generation-webui. Instructions for updating can be found in the project's GitHub repository.