CVE-2026-35050 - Vulnerability Analysis

Overview

text-generation-webui < 4.1.1 contains an unrestricted file upload vulnerability caused by saving extension settings as Python files in the app root directory, letting attackers overwrite and execute arbitrary Python files, exploit requires user to save extension settings.

Severity & Score

Impact

Attackers can execute arbitrary Python code remotely, leading to full system compromise.

Mitigation

Update to version 4.1.1 or later.

References

• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jg96-p5p6-q3cv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner