oobabooga CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL oobabooga CVE published 2026-04-06

CVE-2026-35050

The text-generation-webui application, prior to version 4.1.1, allows users to save extension settings in 'py' format in the app's root directory. This can lead to overwriting of Python files, such as 'download-model.py', which can then be executed from the 'Model' menu when downloading a new model. The vulnerability is exploitable by users with write access to the app's root directory, potentially leadin [truncated]