CVE-2026-108942: Cross Site Scripting in philz1337x clarity-upscaler

This vulnerability involves a cross-site scripting (XSS) flaw in the philz1337x clarity-upscaler software, specifically in the create_html_for_item function of modules/ui_extra_networks.py. The vulnerability arises from improper handling of the Description argument in the Extra Networks Card Rendering component, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The codebase is a rolling release based on AUTOMATIC1111/stable-diffusion-webui v1.7.0, which is vulnerable. The upstream project fixed the issue in version 1.8.0. No official patch or response has been provided by the philz1337x project as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary scripts in users' browsers via the Description field, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no user interaction beyond visiting a crafted page and has low attack complexity but requires low privileges and user interaction. The impact is limited to client-side script execution without direct server compromise.

As of the publication date, no official fix has been released by the philz1337x project. Users should upgrade to or apply the fix from the upstream AUTOMATIC1111/stable-diffusion-webui version 1.8.0 or later, where this vulnerability is addressed. Until an official patch is available, avoid processing untrusted input in the Description argument or apply manual input sanitization to mitigate XSS risks.