Cyber Resilience

CVE-2025-12488

Published
06 November 2025
Modified
15 April 2026
CVSS Score v3 9.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0085 55th percentile
Risk Priority 76 floored blend · peak EPSS

Summary

CVE-2025-12488 is a critical-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-12488 is a remote code execution vulnerability in oobabooga text-generation-webui stemming from reliance on untrusted inputs when processing the trust_remote_code parameter supplied to the load endpoint. The flaw arises from insufficient validation of the user-supplied argument before it is used to load a model, allowing arbitrary code execution in the context of the service account. The issue affects installations of the webui and carries a CVSS score of 9.8.

Unauthenticated remote attackers can exploit the vulnerability over the network by sending a crafted request to the load endpoint, achieving full control over the affected system without requiring user interaction or credentials.

A patch addressing the issue is available in the referenced commit to the text-generation-webui repository, and further details are provided in the Zero Day Initiative advisory ZDI-25-981.

The EPSS score for this CVE rose from a low starting value to a peak of 0.0284, indicating emerging exploitation interest after disclosure. The affected software is commonly used in AI/ML text-generation workflows.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability. The specific flaw exists within the…

more

handling of the trust_remote_code parameter provided to the load endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-26680.

CWE(s)

AI Security AnalysisAI

AI Category
LLM Application Platforms
Risk Domain
Supply Chain and Deployment
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: text-generation-webui

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
T1556 Modify Authentication Process Defense Impairment
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-12487Shared CWE-807
CVE-2024-9310Shared CWE-807
CVE-2025-11271Shared CWE-807
CVE-2024-45654Shared CWE-807
CVE-2026-35655Shared CWE-807
CVE-2026-41299Shared CWE-807
CVE-2026-16093Shared CWE-807
CVE-2023-0009Shared CWE-807
CVE-2026-35624Shared CWE-807
CVE-2026-32898Shared CWE-807

Affected Assets

Zerodayinitiative
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

Explicitly requires that every access decision be based on authoritative, protected decision data rather than caller-supplied inputs.

Input validation can reject malformed or attacker-controlled values before they reach a security decision point.

Access enforcement requires decisions to be made from trusted policy data rather than modifiable client-supplied inputs.

Information-flow enforcement applies rules to validated, internal attributes instead of untrusted external values.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms directly prevent security decisions from depending on modifiable, untrusted inputs.

PR.AA-04 mostly match
prevents

Verification and protection of identity assertions stops reliance on attacker-controlled values for authorization decisions.

PR.AA-01 partial match
prevents

Proper management of identities/credentials reduces the chance that security decisions will be driven by untrusted inputs.

PR.AA-05 partial match
prevents

Policy-driven, least-privilege authorization reduces opportunities to bypass controls via tampered inputs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards directly prohibit using untrusted inputs for security-critical decisions.

finds

Security testing in development catches input-validation flaws before deployment.

finds

Monitoring can detect exploitation but does not stop the underlying weakness.

prevents

Application security requirements explicitly call for validation of inputs used in security decisions.

prevents

Secure architecture principles mandate treating all external inputs as untrusted.

prevents

Access-control rules can be bypassed if they rely on untrusted inputs.

References