The oobabooga text-generation-webui versions before 4.3 contain an SSRF vulnerability (CWE-918) in the superbooga and superboogav2 RAG extensions. These extensions use requests.get() to fetch URLs supplied by users without any validation such as scheme checks, IP filtering, or hostname allowlisting. This flaw allows attackers to make the server request internal or protected resources, including cloud metadata endpoints, potentially leading to credential theft and internal service probing. The vulnerability is addressed in version 4.3 of the software.

An attacker can exploit this SSRF vulnerability to access sensitive internal resources, including cloud metadata endpoints, which may lead to the theft of IAM credentials. The attacker can also probe internal services that are otherwise inaccessible externally. The vulnerability does not impact integrity or availability but has a high impact on confidentiality.

Upgrade the oobabooga text-generation-webui to version 4.3 or later, where this SSRF vulnerability has been fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix in version 4.3, so users should verify the upgrade to this or a later version.