CVE-2026-111987
mediumA vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/ cna@vuldb.com
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17500 cna@vuldb.com
- https://github.com/user-attachments/files/32834382/a1111-sshs-hash-poc.zip cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-111987 cna@vuldb.com
- https://vuldb.com/submit/1006710 cna@vuldb.com
- https://vuldb.com/vuln/421653 cna@vuldb.com
- https://vuldb.com/vuln/421653/cti cna@vuldb.com