CVE-2026-111987 Details
Description
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site scripting (XSS) vulnerability has been identified in AUTOMATIC1111 stable-diffusion-webui versions through 1.10.1. The issue arises in the Extra-Networks Card Builder component, specifically within the read_metadata_from_safetensors function in modules/sd_models.py. The vulnerability is triggered by manipulating the __metadata__.sshs_model_hash argument, which is not properly validated before being used. This flaw allows for the injection of malicious scripts that are executed when the page is loaded, potentially leading to unauthorized actions such as executing code through the application's extension installer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AUTOMATIC1111/stable-diffusion-webui/ | [email protected] | Vendor |
| https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17500 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/user-attachments/files/32834382/a1111-sshs-hash-poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-111987 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1006710 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421653 | [email protected] | Content Wall |
| https://vuldb.com/vuln/421653/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AUTOMATIC1111 stable-diffusion-webui | <= 1.10.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |