A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. (CVE-2026-111986)

CVE-2026-111986 describes a code injection vulnerability in AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1. The flaw resides in the get_obj_from_str function within the modules/sd_models.py file, specifically in the Model Instantiation component. An attacker can remotely manipulate the Target argument to inject code. The vulnerability was reported early to the project, but no response or patch has been provided. The CVSS 3.1 base score is 6.3, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to code injection, which may allow an attacker to execute arbitrary code remotely. This could compromise the confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction. No known exploits are currently observed in the wild.

No official fix or patch is currently available. Users should monitor the project for updates and apply any future patches promptly. Until a fix is released, avoid exposing the vulnerable service to untrusted networks or users to reduce risk.