text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access cloud metadata endpoints, steal IAM credentials, and probe internal services. The fetched content is exfiltrated through the RAG pipeline. This vulnerability is fixed in 4.3.
References
| Link | Resource |
|---|---|
| https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2 | Exploit Vendor Advisory |
| https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2 | Exploit Vendor Advisory |
Configurations
History
09 Apr 2026, 18:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2 - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:oobabooga:text_generation_web_ui:*:*:*:*:*:*:*:* | |
| First Time |
Oobabooga text Generation Web Ui
Oobabooga |
09 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2 - |
07 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 16:16
Updated : 2026-04-09 18:48
NVD link : CVE-2026-35486
Mitre link : CVE-2026-35486
CVE.ORG link : CVE-2026-35486
JSON object : View
Products Affected
oobabooga
- text_generation_web_ui
CWE
CWE-918
Server-Side Request Forgery (SSRF)