Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-111987: stable-diffusion-webui can run malicious scripts in browsers
CVE-2026-111987 · published today
Summary
The web interface of AUTOMATIC1111’s stable‑diffusion‑webui (up to version 1.10.1) lets an attacker insert specially crafted data that causes a web page to execute unwanted script code. This can be triggered from anywhere on the Internet and could let a user’s browser be hijacked or their data stolen. Apply the latest software update or patch the affected function to stop the unwanted script execution.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| automatic1111 | stable-diffusion-webui | 1.10.0 |
Original advisory text
AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://vuldb.com/vuln/421653 Vendor Advisory
- https://vuldb.com/vuln/421653/cti Third Party Advisory
- https://vuldb.com/cve/CVE-2026-111987 Vendor Advisory
- https://vuldb.com/submit/1006710 Vendor Advisory
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17500 Third Party Advisory
- https://github.com/user-attachments/files/32834382/a1111-sshs-hash-poc.zip Exploit
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1119... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111987 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
7.8
High
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published18 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta