CVE-2026-35050

OVERVIEW CVE-2026-35050 affects text-generation-webui, an open-source web interface for executing Large Language Models. Versions prior to 4.1.1 contain a file overwrite vulnerability where users can save extension settings in Python format within the application root directory, enabling malicious actors to overwrite critical Python files such as "download-model.py." These compromised files can subsequently be executed when triggered through the Model menu's download functionality. SEVERITY This vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and low privileges to exploit. No user interaction is required for successful exploitation. The impact is severe, conferring high confidentiality, integrity, and availability compromise to the affected system. The vulnerability enables arbitrary code execution on the host system where text-generation-webui is deployed. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild. The EPSS score of 0.0008 indicates minimal probability of exploitation compared to other known CVEs. No exploit code has been publicly disclosed, and the vulnerability has not been included on CISA's Known Exploited Vulnerabilities list. Community attention remains low relative to the severity rating. Immediate patching to version 4.1.1 is recommended to remediate this risk.