CVE-2026-108942 Details
Description
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description results in cross site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code. Upstream AUTOMATIC1111/stable-diffusion-webui (v1.8.0, released March 1, 2024) contains the fix. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site scripting (XSS) vulnerability has been identified in philz1337x clarity-upscaler versions prior to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. The issue arises in the 'create_html_for_item' function within 'modules/ui_extra_networks.py', specifically in the Extra Networks Card Rendering component. The vulnerability allows for the injection of malicious scripts through the 'description' argument, which is not properly escaped before being rendered as HTML. This flaw can be exploited remotely, particularly by packaging a model with a sidecar file containing the unescaped JavaScript, which executes when the Extra Networks panel is opened.
The vulnerability has been fixed in the upstream version 1.8.0 of AUTOMATIC1111/stable-diffusion-webui. Users should update to this version. For those using clarity-upscaler, the issue can be addressed by escaping the 'description' field in the 'create_html_for_item' function, similar to how sibling fields are handled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/philz1337x/clarity-upscaler/ | [email protected] | ProductVendor |
| https://github.com/philz1337x/clarity-upscaler/issues/72 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-108942 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/997640 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416767 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416767/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| philz1337x clarity-upscaler | <= cfbdb842c6c839c8e97741722b8cf9a4b7662d98 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |