CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...

CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...

PT-2025-41812

Name of the Vulnerable Software and Affected Versions text-generation-webui versions through 3.13 Description text-generation-webui is a web interface for running Large Language Models. A Local File Inclusion issue exists in the character picture upload feature. An attacker can upload a text file...

CVE-2025-62364: Improper Link Resolution Before File Access

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...

Text Generation Web UI Postback Link Vulnerability

Text Generation Web UI is a UI interface for native AI by oobabooga individual developers. A backlink vulnerability exists in Text Generation Web UI version 3.13 and earlier, which stems from a local file inclusion vulnerability in the character image upload feature that could result in reading...

text-generation-inference: Unbounded external image fetch in validation leads to resource-exhaustion DoS

Description Text Generation Inference Router DoS via pre-validation image fetch in VLM mode. Affected: Router workspace version 3.3.6 the latest repo, when deployed with a vision/VLM model e.g., Idefics/Mllama/Idefics2/Idefics3/Gemma3/Llama4/Paligemma/LlavaNext/Qwen2VL/Qwen25VL. Pure text LLMs do...

Hashed Watermark As a Filter: Defeating Forging and Overwriting Attacks in Weight-Based Neural Network Watermarking

As valuable digital assets, deep neural networks necessitate robust ownership protection, positioning neural network watermarking NNW as a promising solution. Among various NNW approaches, weight-based methods are favored for their simplicity and practicality; however, they remain vulnerable to...

False Alarms, Real Damage: Adversarial Attacks Using LLM-Based Models on Text-Based Cyber Threat Intelligence Systems

Cyber Threat Intelligence CTI has emerged as a vital complementary approach that operates in the early phases of the cyber threat lifecycle. CTI involves collecting, processing, and analyzing threat data to provide a more accurate and rapid understanding of cyber threats. Due to the large volume ...

developergpt (>=0.4.0, <=0.7.5), genericsuite-ai (>=0.1.10, <=0.1.14) +2 more potentially affected by CVE-2024-3924 via text-generation (0.6.1)

text-generation PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on text-generation and may be impacted: - developergpt =0.4.0, =0.1.10, =3.0.0, =0.1.2, =0.1.5 Source cves: CVE-2024-3924 Source advisory: OSV:GHSA-QQ99-P57R-G3V7...

ai4data (0.0.1), aihero (0.3.1) +20 more potentially affected by CVE-2024-3924 via text-generation (0.7.0)

text-generation PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on text-generation and may be impacted: - ai4data 0.0.1 - aihero 0.3.1 - airunner =3.0.0, =2.0.0, =0.0.2, =0.1.4, =0.2.6, =0.0.1, =0.1.0, =0.1.5, =0.1.0, =0.3.2 -...

GHSA-QQ99-P57R-G3V7 code injection vulnerability exists in the huggingface/text-generation-inference repository

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924: Improper Control of Generation of Code

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

Text Generation Inference Security Vulnerabilities

Text Generation Inference is a Rust, Python and gRPC server for text generation inference. A security vulnerability exists in Text Generation Inference version 2.0.0 and earlier, which stems from insecure handling of user input and a code injection vulnerability that could be exploited by an...

PT-2024-28404

Name of the Vulnerable Software and Affected Versions huggingface/text-generation-inference versions up to and including v2.0.0 Description A code injection issue exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The issue arises...

AIs and Fake Comments

This month, the New York state attorney general issued a report on a scheme by "U.S. Companies and Partisans to Hack Democracy." This wasn’t another attempt by Republicans to make it harder for Black people and urban residents to vote. It was a concerted attack on another core element of US...

Artificial Personas and Public Discourse

Presidential campaign season is officially, officially, upon us now, which means it's time to confront the weird and insidious ways in which technology is warping politics. One of the biggest threats on the horizon: artificial personas are coming, and they're poised to take over political debate...