Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

oobabooga/text-generation-webui

              main @ c93f887
            

Fixes

CVEs

CRITICAL

Peak severity

62.5%

Coverage

Highlights

Path Traversal: 6 prior fixes. Scrutinize any change in this area.

modules/chat.py: most-fixed (8 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple fixes address unsanitized filenames in save/delete operations and character/prompt loading, indicating a systemic lack of centralized filename sanitization.

SSRF: Three fixes target user-controlled URLs reaching requests.get, with progressively stronger IP validation, indicating a need for a single robust URL validator used everywhere.

Code Injection: A critical fix replaced eval/exec with safe alternatives across multiple components, showing a broad attack surface for arbitrary code execution via user input.