Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-111986: stable-diffusion-webui can run foreign code remotely

CVE-2026-111986 · published today

Summary

The web interface of AUTOMATIC1111's stable-diffusion-webui (up to version 1.10.1) lets an attacker send specially crafted data that causes the server to execute their own commands. This can be triggered over the network without needing credentials. Apply the latest update from the project or restrict access to the interface until a fix is released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
automatic1111	stable-diffusion-webui	1.10.0

Original advisory text

AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/vuln/421652 Vendor Advisory
https://vuldb.com/vuln/421652/cti Third Party Advisory
https://vuldb.com/cve/CVE-2026-111986 Vendor Advisory
https://vuldb.com/submit/1006657 Vendor Advisory
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499 Third Party Advisory
https://github.com/user-attachments/files/32834193/a1111-yaml-target-poc.zip Exploit
https://github.com/AUTOMATIC1111/stable-diffusion-webui/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1119... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-111986 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

8.4 High

Type

CWE-74Injection

CWE-94Code Injection

Timeline

Published18 Oct 2026

Updated19 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-111986 · NVD

CVE-2026-111986 · MITRE

CVE-2026-111986 · OSV

Track software like this

Free during beta